title: SSLHandshakeException: Handshake failed SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER
body: <p>Getting back to Android after a while. I just purchased an EV certificate and am trying to connect using SSL/TSL to my web service. I'm getting:</p>
  <pre><code>2021-07-23 09:52:12.009 26190-26225/xx.xx.wb5000dispenser E/xx.xx.wb5000dispenser.service.DispenseServiceImpl: Error registering site
      javax.net.ssl.SSLHandshakeException: Handshake failed
          at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:286)
          at com.android.okhttp.internal.io.RealConnection.connectTls(RealConnection.java:192)
          at com.android.okhttp.internal.io.RealConnection.connectSocket(RealConnection.java:149)
          at com.android.okhttp.internal.io.RealConnection.connect(RealConnection.java:112)
          at com.android.okhttp.internal.http.StreamAllocation.findConnection(StreamAllocation.java:184)
          at com.android.okhttp.internal.http.StreamAllocation.findHealthyConnection(StreamAllocation.java:126)
          at com.android.okhttp.internal.http.StreamAllocation.newStream(StreamAllocation.java:95)
          at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:299)
          at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:237)
          at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:472)
          at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:127)
          at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getOutputStream(HttpURLConnectionImpl.java:258)
          at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getOutputStream(DelegatingHttpsURLConnection.java:218)
          at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:26)
          at xx.xx.wb5000dispenser.service.DispenseServiceImpl.callPost(DispenseServiceImpl.java:72)
          at xx.xx.wb5000dispenser.service.DispenseServiceImpl.registerSite(DispenseServiceImpl.java:50)
          at xx.xx.wb5000dispenser.service.Wb5000Service$DailyRegisterThread.run(Wb5000Service.java:57)
       Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x9fa470c8: Failure in SSL library, usually a protocol error
      error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER (external/boringssl/src/ssl/tls_record.cc:242 0x9d1e6f1b:0x00000000)
          at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
          at com.android.org.conscrypt.NativeSsl.doHandshake(NativeSsl.java:375)
          at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:224)
              ... 16 more
  </code></pre>
  <p>I found on one of the answers here that I should try testssl.sh. I installed that and here's some of the report...</p>
  <pre><code>...
  Testing protocols via sockets except NPN+ALPN 
  
   SSLv2      not offered (OK)
   SSLv3      not offered (OK)
   TLS 1      not offered
   TLS 1.1    not offered
   TLS 1.2    offered (OK)
   TLS 1.3    offered (OK): final
   NPN/SPDY   http/1.1 (advertised)
   ALPN/HTTP2 http/1.1 (offered)
  ...
   Rating (experimental) 
  
   Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009q from 2020-01-30)
   Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
   Protocol Support (weighted)  100 (30)
   Key Exchange     (weighted)  90 (27)
   Cipher Strength  (weighted)  90 (36)
   Final Score                  93
   Overall Grade                A
   Grade cap reasons            Grade capped to A. HSTS is not offered
  </code></pre>
  <p>Let me know if it would be useful to see more...</p>
  <p>I looked on the server (nginx hosted on AWS) and there were no errors in the log during this period.</p>
  <p>Here is the creation of the SSL context:</p>
  <pre><code>    try {
          sslContext = SSLContext.getInstance(&quot;TLSv1.2&quot;);
          sslContext.init(null, null, new java.security.SecureRandom());
      } catch (NoSuchAlgorithmException | KeyManagementException ex) {
          Log.e(TAG, &quot;Error creating SSL context&quot;, ex);
      }
  </code></pre>
  <p>TSLv1.3 failed as unsupported.</p>
  <p>Here is my connection code:</p>
  <pre><code>    try {
          URL url = new URL(urlName);
          HttpsURLConnection urlConnection = (HttpsURLConnection) url.openConnection();
          urlConnection.setSSLSocketFactory(sslContext.getSocketFactory());
          urlConnection.setDoOutput(true);
          urlConnection.setFixedLengthStreamingMode(bytesToSend.length);
  
          OutputStream out = new BufferedOutputStream(urlConnection.getOutputStream()); //Exception here
          out.write(bytesToSend);
          out.flush();
  
          InputStream in = new BufferedInputStream(urlConnection.getInputStream());
          result = readStreamAsString(in);
      }
     catch(Exception exception) {
          Log.e(TAG, &quot;Error registering site&quot;, exception);
          throw new Square1Exception(&quot;Error hitting:&quot; + urlName, exception);
      }
  </code></pre>
  <p>Blows up as indicated on the creation of the output stream.</p>
  <p>My tablet is running Android 9, which is much newer than most of the similar issues I've found.</p>
  <p>All advice appreciated.</p>