Unable to extract the trust manager

[AlexLardschneider]

Hi,
after upgrading from OkHttp 3.0.1 to 3.1.0 I get the following stack trace and crash after calling build() to create a OkHttpClient.

java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.Platform$Android@1d8cf999, sslSocketFactory is class com.google.android.gms.org.conscrypt.KitKatPlatformOpenSSLSocketAdapterFactory
                                                                        at okhttp3.OkHttpClient.<init>(OkHttpClient.java:187)
                                                                        at okhttp3.OkHttpClient.<init>(OkHttpClient.java:60)
                                                                        at okhttp3.OkHttpClient$Builder.build(OkHttpClient.java:719)

This issue was not present in 3.0.1.

Here's where the crash happens:

OkHttpClient.Builder builder = new OkHttpClient.Builder()
                    .connectTimeout(10, TimeUnit.SECONDS)
                    .writeTimeout(10, TimeUnit.SECONDS)
                    .readTimeout(30, TimeUnit.SECONDS);

            OkHttpClient client = builder.build();

[swankjesse]

Ahh, yeah I gotta fix this for the GMS TLS stack. Will fix.

[swankjesse]

Released as 3.1.1 and 2.7.4.

[artem-zinnatullin]

Just re-checked with 3.1.1, unfortunately, still doesn't work under Robolectric but works on actual Android (API 23).

Caused by: java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.Platform$Android@20bcec4c, sslSocketFactory is class sun.security.ssl.SSLSocketFactoryImpl
    at okhttp3.OkHttpClient.<init>(OkHttpClient.java:186)
    at okhttp3.OkHttpClient.<init>(OkHttpClient.java:60)
    at okhttp3.OkHttpClient$Builder.build(OkHttpClient.java:718)

[ghost]

Same thing here, robolectric tests are now crashing after upgrade from 3.0.0-RC1

[kkocel]

Same here on robolectric tests:

java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.Platform$Android@19f0acf3, sslSocketFactory is class sun.security.ssl.SSLSocketFactoryImpl at okhttp3.OkHttpClient.<init>(OkHttpClient.java:187) at okhttp3.OkHttpClient.<init>(OkHttpClient.java:151)

[jhansche]

@swankjesse please see above: should this be reopened, or would you prefer a new issue opened for the sun.security.ssl.SSLSocketFactoryImpl issue?

[swankjesse]

Fixes for Robolectric released in OkHttp 3.1.2.

[ghost]

Yupp, Robolectric tests are now back to normal, thanks!

[kacamak]

Hi,
same here

Unable to extract the trust manager on okhttp3.internal.Platform$Android@53244b48, sslSocketFactory is class crittercism.android.q at okhttp3.OkHttpClient.(OkHttpClient.java:187)
at okhttp3.OkHttpClient.(OkHttpClient.java:151)

[PieterAelse]

This issue should be re-opened, I still have the same issue using Retrofit 2.0.0-beta4 (/OkHttp 3.1.2) in combination with Crittercism (5.5.5-rc-1 to be exact).

Error:

Caused by: java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.Platform$Android@2e3d9cee, sslSocketFactory is class crittercism.android.q
                                                                                at okhttp3.OkHttpClient.<init>(OkHttpClient.java:187)
                                                                                at okhttp3.OkHttpClient.<init>(OkHttpClient.java:60)
                                                                                at okhttp3.OkHttpClient$Builder.build(OkHttpClient.java:718)
                                                                                at [mypackage].modules.AppModule.provideOkHttpClient(AppModule.java:385)

[swankjesse]

@kacamak , @PieterAelse ugh! You guys interested in trying to help out with the fix? I need to be able to extract the X509TrustManager instance from the SSLSocketFactory, but I don’t know anything about the SSLSocketFactory that gets configured when you use Crittercism. (Also, why is Crittercism customizing the system’s SSL? That seems sketchy.)

[braebot]

@swankjesse, some folks are seeing this in the PayPal Sdk too. PayPal uses custom SSLSocketFactory for pinning purposes and to enable TLSv1.2 on API 16-19 devices.

[rfc2822]

Have this problem with DAVdroid's SSLSocketFactoryCompat.

Has anything changed in how SSLSocketFactories should be set?

[swankjesse]

If you rename that factory’s private defaultFactory field to delegate, the hacky detector we use will do the right thing.

[jaypatel512]

Can you please elaborate on your above comment a little bit more @swankjesse !! That would be very helpful.

[iNoles]

private SSLSocketFactory defaultFactory;

to

private SSLSocketFactory delegate;

[jaypatel512]

Thanks @iNoles ! I had a complete different thing in mind :) This was easy.

[rfc2822]

Can confirm that it works with private SSLSocketFactory delegate. And I won't question it ;)

[PieterAelse]

@swankjesse I also don't know whyyy Crittercism is doing anything with SSL. So I'm also not sure how I'll be able to help you out with getting the SSLSocketFactory.

[mrbipbip]

Hi, same issue Here wirh the Crittercism API.

[jisturiz]

Hey there, also seeing the same issue. Specifically with the combination of Crittercism and Optimizely...

[aryarohit07]

Still same issue with Crittercism.

Caused by: java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.Platform$Android@256897c7, sslSocketFactory is class crittercism.android.q
                                                                        at okhttp3.OkHttpClient.<init>(OkHttpClient.java:187)
                                                                        at okhttp3.OkHttpClient.<init>(OkHttpClient.java:151)

[stefanomerlano]

@jkang-critter when Crittercism 5.6.2 update fix will be integrated in cordova-plugin-apteligent ?

[codebaum]

I was able to make it work with Retrofit 2.0.2 and Crittercism 5.5.5, but I had to disable service monitoring via CrittercismConfig.

EDIT: see response below

[dshirley]

@codebaum You shouldn't have to disable service monitoring anymore. The bug was fixed in Crittercism 5.6.1. An even later version (5.6.3( is now available.

[codebaum]

@dshirley Never mind, I thought it wasn't working with 5.6.3-rc-1 but I re-tested and I'm not seeing a crash anymore.

[rogerhu]

Just a friendly ping to see if we can get a fix/release for this issue. Trying to get things updated for the Parse SDK so would want to have a way to make a call to systemDefaultTrustManager()

[jpstotz]

I have read the discussion on this issue, however I am totally confused by all the discussion on 3rd party libraries that just use OkHttp. My major problem is that I neither do see a clear description why this error is occurring nor how to fix it (or better how to get around it).

I am using plain OkHttp 3.2.0 and Android with my custom SSLSocketFactor and TrustManager implementation.

[ghost]

I'm personally getting this error with Retrofit2 v2.0.2:

Unhandled exception: java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.Platform@29eaf7d1, sslSocketFactory is class sun.security.ssl.SSLSocketFactoryImpl at okhttp3.OkHttpClient.<init>(OkHttpClient.java:187) [okhttp-3.2.0.jar:] at okhttp3.OkHttpClient.<init>(OkHttpClient.java:60) [okhttp-3.2.0.jar:] at okhttp3.OkHttpClient$Builder.build(OkHttpClient.java:718) [okhttp-3.2.0.jar:]

[andrei-ivanov]

Using OkHttp 3.3.0-SNAPSHOT fixed the issue for me.

[PieterAelse]

Was fixed here by using Crittercism v5.6.3

[stefanomerlano]

When Crittercism v5.6.3 will be integrated in cordova-plugin-apteligent ?
Right now it's using release 5.5.2 and I still have the issue in my hybrid app.

[theScud]

Hey so i'm running both Crittercsim 5.6.4 and OkHttp V3.3.0 and still facing the crash. Any update on how to fix it ?

[Pitel]

We're also having this crash. Only on Androids 4.0 and 4.1.

[feresr]

+1 Having this same issue on retrofit:2.1.0, I'm simply trying to build an instance of retrofit on the setUp method of a test.
I'm not event using roboelectric, I am using Mockito and PowerMock though

    testCompile 'org.mockito:mockito-core:1.10.19'
    testCompile 'org.powermock:powermock:1.6.5'
    testCompile 'org.powermock:powermock-module-junit4:1.6.5'
    testCompile 'org.powermock:powermock-api-mockito:1.6.5'

@Before public void setUp() throws Exception {
        MockitoAnnotations.initMocks(this);

        Retrofit retrofit = new Retrofit.Builder()
                .baseUrl(BuildConfig.BASE_URL)
                .build(); //Crash here -> java.lang.AssertionError at okhttp3.OkHttpClient.systemDefaultTrustManager(OkHttpClient.java:260)

}

Full stacktrace:

java.lang.AssertionError
    at okhttp3.OkHttpClient.systemDefaultTrustManager(OkHttpClient.java:260)
    at okhttp3.OkHttpClient.<init>(OkHttpClient.java:228)
    at okhttp3.OkHttpClient.<init>(OkHttpClient.java:203)
    at retrofit2.Retrofit$Builder.build(Retrofit.java:551)
    at com.productify.urge.usecase.GetCategoriesUseCaseTest.setUp(GetCategoriesUseCaseTest.java:68)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.junit.internal.runners.MethodRoadie.runBefores(MethodRoadie.java:133)
    at org.junit.internal.runners.MethodRoadie.runBeforesThenTestThenAfters(MethodRoadie.java:96)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit44RunnerDelegateImpl$PowerMockJUnit44MethodRunner.executeTest(PowerMockJUnit44RunnerDelegateImpl.java:300)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit47RunnerDelegateImpl$PowerMockJUnit47MethodRunner.executeTestInSuper(PowerMockJUnit47RunnerDelegateImpl.java:131)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit47RunnerDelegateImpl$PowerMockJUnit47MethodRunner.access$100(PowerMockJUnit47RunnerDelegateImpl.java:59)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit47RunnerDelegateImpl$PowerMockJUnit47MethodRunner$TestExecutorStatement.evaluate(PowerMockJUnit47RunnerDelegateImpl.java:147)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit47RunnerDelegateImpl$PowerMockJUnit47MethodRunner.evaluateStatement(PowerMockJUnit47RunnerDelegateImpl.java:107)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit47RunnerDelegateImpl$PowerMockJUnit47MethodRunner.executeTest(PowerMockJUnit47RunnerDelegateImpl.java:82)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit44RunnerDelegateImpl$PowerMockJUnit44MethodRunner.runBeforesThenTestThenAfters(PowerMockJUnit44RunnerDelegateImpl.java:288)
    at org.junit.internal.runners.MethodRoadie.runTest(MethodRoadie.java:87)
    at org.junit.internal.runners.MethodRoadie.run(MethodRoadie.java:50)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit44RunnerDelegateImpl.invokeTestMethod(PowerMockJUnit44RunnerDelegateImpl.java:208)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit44RunnerDelegateImpl.runMethods(PowerMockJUnit44RunnerDelegateImpl.java:147)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit44RunnerDelegateImpl$1.run(PowerMockJUnit44RunnerDelegateImpl.java:121)
    at org.junit.internal.runners.ClassRoadie.runUnprotected(ClassRoadie.java:34)
    at org.junit.internal.runners.ClassRoadie.runProtected(ClassRoadie.java:44)
    at org.powermock.modules.junit4.internal.impl.PowerMockJUnit44RunnerDelegateImpl.run(PowerMockJUnit44RunnerDelegateImpl.java:123)
    at org.powermock.modules.junit4.common.internal.impl.JUnit4TestSuiteChunkerImpl.run(JUnit4TestSuiteChunkerImpl.java:121)
    at org.powermock.modules.junit4.common.internal.impl.AbstractCommonPowerMockRunner.run(AbstractCommonPowerMockRunner.java:53)
    at org.powermock.modules.junit4.PowerMockRunner.run(PowerMockRunner.java:59)
    at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
    at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
    at com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:234)
    at com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:74)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:144)

[swankjesse]

Can you put a breakpoint on OkHttpClient.java:260 and see what the cause is?

[feresr]

Sure, the following line on OkHttpClient.java

 private X509TrustManager systemDefaultTrustManager() {
    try {
      TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(
          TrustManagerFactory.getDefaultAlgorithm());

Throws this exception:

java.security.NoSuchAlgorithmException: class configured for TrustManagerFactory: sun.security.ssl.TrustManagerFactoryImpl$PKIXFactory not a TrustManagerFactory

TrustManagerFactory.getDefaultAlgorithm() returns the string: "PKIX"

Hope that helps

[swankjesse]

@feresr looks like PowerMock is causing you harm here.
http://stackoverflow.com/questions/14654639/when-a-trustmanagerfactory-is-not-a-trustmanagerfactory-java

[feresr]

@swankjesse Yes, thank you! that was exactly it. that solved my issue.

[kchvilyov]

Why Class.forName("sun.security.ssl.SSLContextImpl") has not found here?
Class<?> sslContextClass = Class.forName("sun.security.ssl.SSLContextImpl");
Result message:
ERROR org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/].[ProxyServlet] Servlet.service() for servlet ProxyServlet threw exception: java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.Platform@67ec7968, sslSocketFactory is class sun.security.ssl.SSLSocketFactoryImpl
at okhttp3.OkHttpClient.(OkHttpClient.java:187) [okhttp-3.2.0.jar:]
at okhttp3.OkHttpClient.(OkHttpClient.java:60) [okhttp-3.2.0.jar:]
at okhttp3.OkHttpClient$Builder.build(OkHttpClient.java:718) [okhttp-3.2.0.jar:]
at com.graphhopper.api.GraphHopperWeb.(GraphHopperWeb.java:66) [directions-api-java-client-0.7.0.1.jar:]
at com.graphhopper.api.GraphHopperWeb.(GraphHopperWeb.java:58) [directions-api-java-client-0.7.0.1.jar:]

From the code:
final GraphHopperWeb gh = new GraphHopperWeb();

Server: JBoss AS 7.1.1.Final "Brontes"

pom.xml:
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion> <groupId>routeplanner2</groupId> <artifactId>routeplanner2</artifactId> <packaging>war</packaging> <version>2.0</version> <name>routeplanner2</name> <properties> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <maven.compiler.source>1.6</maven.compiler.source> <maven.compiler.target>1.6</maven.compiler.target> </properties> <dependencies> <dependency> <groupId>org.jboss.spec</groupId> <artifactId>jboss-javaee-6.0</artifactId> <version>1.0.0.Final</version> <type>pom</type> <scope>provided</scope> </dependency> <dependency> <groupId>com.googlecode.objectify</groupId> <artifactId>objectify</artifactId> <version>5.1.10</version> </dependency> <dependency> <groupId>com.google.appengine</groupId> <artifactId>appengine-api-1.0-sdk</artifactId> <version>1.8.9</version> </dependency> <!-- GraphHopper --> <dependency> <groupId>com.graphhopper</groupId> <!-- artifactId>graphhopper-core</artifactId> <version>0.8-SNAPSHOT</version --> <artifactId>graphhopper</artifactId> <version>0.7.0</version> <exclusions> <exclusion> <groupId>org.apache.xmlgraphics</groupId> <artifactId>xmlgraphics-commons</artifactId> </exclusion> </exclusions> </dependency> <dependency> <groupId>com.graphhopper</groupId> <artifactId>directions-api-java-client</artifactId> <version>0.7.0.1</version> </dependency> </dependencies> <profiles> <profile> <id>openshift</id> <build> <finalName>routeplanner2</finalName> <plugins> <plugin> <artifactId>maven-war-plugin</artifactId> <version>2.1.1</version> <configuration> <outputDirectory>deployments</outputDirectory> <warName>ROOT</warName> </configuration> </plugin> </plugins> </build> </profile> </profiles> </project>

[akabirami]

okhttp:3.1.2 and retrofit 2.0.2 but still getting the issue
java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.Platform

[JeffreyCA]

I experienced this error while using a custom SocketFactory. I realized I didn't add all the necessary ProGuard rules. I added the following to fix the issue:

-keepclassmembers class * implements javax.net.ssl.SSLSocketFactory {
    private final javax.net.ssl.SSLSocketFactory delegate;
}

In my SocketFactory class, I had the following field:

private final SSLSocketFactory delegate;

So adjust the ProGuard rule accordingly. E.g, the access modifiers like private, final, etc. as well as the field name (delegate) should match exactly as written in the class file.

[Navneet7k]

@swankjesse iam not getting why wont it work without the delegate hack

[HaghighatDoost]

@JeffreyCA ooooooof you saved my life :))

[erlangparasu]

private SSLSocketFactory delegate; works 👍