Since the bump to reqwest 0.13 in #6053 we had some trouble getting the HTTP client going on Android.
reqwest 0.13 switched to rustls and rustls-platform-verifier by default in seanmonstar/reqwest#2891.
While Android used rustls it used the webpki crate for certificate verification instead of the rustls-platform-verifier.
The first issue we ran into was #6279 which was caused by the fact that Android requires additional custom setup steps to get the rustls-platform-verifier working. This issue was fixed by #6306.
The next issue, which we are currently experiencing is rustls/rustls-platform-verifier#221.
The rustls-platform-verifier on Android incorrectly marks some certificates as revoked. The same certificates work on other platforms. This seems to be due to the fact that verifying the certificate requires the download of a Certificate revocation list (CRL).
This CRL is served over HTTP, while Androids default network stack disallows clear text HTTP traffic and expects HTTPS.
Possible solutions
A workaround to allow the download of CRLs over HTTP traffic exists. HTTP traffic can be enabled in the app manifest. It can be also enabled on a per-domain basis, but collecting all the domains we would need to whitelist isn't an easy task. Upstream plans to provide such a list but this isn't available as of yet.
The other solution would be to go back to webpki for the certificate verification, which brings us back to the situation we had prior the reqwest bump. This isn't trivial as the feature flags to use webpki were removed from reqwest.
Since the bump to
reqwest0.13 in #6053 we had some trouble getting the HTTP client going on Android.reqwest0.13 switched torustlsandrustls-platform-verifierby default in seanmonstar/reqwest#2891.While Android used
rustlsit used thewebpkicrate for certificate verification instead of therustls-platform-verifier.The first issue we ran into was #6279 which was caused by the fact that Android requires additional custom setup steps to get the
rustls-platform-verifierworking. This issue was fixed by #6306.The next issue, which we are currently experiencing is rustls/rustls-platform-verifier#221.
The
rustls-platform-verifieron Android incorrectly marks some certificates as revoked. The same certificates work on other platforms. This seems to be due to the fact that verifying the certificate requires the download of a Certificate revocation list (CRL).This CRL is served over HTTP, while Androids default network stack disallows clear text HTTP traffic and expects HTTPS.
Possible solutions
A workaround to allow the download of CRLs over HTTP traffic exists. HTTP traffic can be enabled in the app manifest. It can be also enabled on a per-domain basis, but collecting all the domains we would need to whitelist isn't an easy task. Upstream plans to provide such a list but this isn't available as of yet.
The other solution would be to go back to
webpkifor the certificate verification, which brings us back to the situation we had prior thereqwestbump. This isn't trivial as the feature flags to usewebpkiwere removed fromreqwest.