Search code examples
androidcordovasslrelease

cordova "release" behaves differently to "debug" regarding SSL

I have very difficult and totally ungoogleable problem with cordova.

A program, working perfectly being compiled in --debug mode, ceases working after compilation in --release mode. I made sure the source is identical, and the effect is constant.

The only difference between --debug build and --release build is that the --release build fails to open any SSL connections.

This problem is localized very narrow, in my case it is the following line:

Socket = new WebSocket('wss://376.su/');

a friend of mine has reported the same error occurrence in the line:

<img src="https://blabla" />;

UPD: the problem is solved see the answers.

Solution

  • Problem

    I have identified the exact source of the problem and i have found the perfect solution. It turned out to be a superposition of two separate issues each of which is seriously misleading:

    1. My SSL certificate from Thawte (despite its cost) is not recognized by Android 5.1.1 as a valid one (while being recognized by all desktop browsers)

    2. The --debug flag in cordova build simply ignores certificate "errors" (silently).

    Solution

    Go to your project's directory and find the following file:

    platforms/android/CordovaLib/src/org/apache/cordova/engine/SystemWebViewClient.java

    Locate the method definition (onReceivedSslError) and the following condition:

    (appInfo.flags & ApplicationInfo.FLAG_DEBUGGABLE) != 0

    This is what makes --debug and --release different. In order to ignore certificate "errors" the following code should be executed:

    handler.proceed();
return;

    This file persists through the build process. Don't forget to ignore those quasi-errors next time you add a platform to your project.