Android client - Restlet 2.0.15 - cannot connect with HTTPS/SSL - recoverable error 1001 -

i have written android web service client using restlet framework android (2.0.15), , i've written web service backend (again restlet 2.0.15 jee) has been uploaded on aws elastic beanstalk (so client calls in form of "http://my_web_service.elasticbeanstalk.com/this/is/my/request"). works fine on http, i'd replace https, has proven more difficult thought.

i have created trial ssl certificate comodo, have declared, cname, domain own (unfortunately, cannot declare elasticbeanstalk.com subdomain, aws load balancer running, certificate hostname). certificate has been uploaded aws instance, , seems running succsefully (tested via web browser, couple of https calls through succesfully after accept certificate on browser). thing don't certificate fact warning may invalid certificate, since declared hostname (my domain) , actual hostname certificate running (elasticbeanstalk.com) not match.

in client i'm using apache http client (have loaded org.apache.httpclient.jar on claspath), , how create client resource use on every call, plain , simple:

clientresource resource = new clientresource(resourceuri);     engine.getinstance().getregisteredclients().clear(); engine.getinstance().getregisteredclients().add(new httpclienthelper(null)); 

of course, resourceuri in form of "https://my_web_service.elasticbeanstalk.com/this/is/my/request", , difference between working http case , non-working https case. https, error below:

a recoverable error detected (1001), attempting again in 2000 ms.

i've tried several suggestions found on google (using org.restlet.ext.net httpclient instead of apache or loading org.restlet.ext.ssl jar restlet android 2.1), nothing has worked far. i've captured network trace wireshark, , here's callflow:

|time     | 192.168.2.111                         | |         |                   | 54.245.249.149    |                    |14.769   |         65430 > https [syn]           |tcp: 65430 > https [syn] seq=0 win=65535 len=0 mss=1460 ws=16 tsval=3906214190 tsecr=0 sack_perm=1 |         |(65430)  ------------------>  (443)    | |15.026   |         https > 65430 [syn,           |tcp: https > 65430 [syn, ack] seq=0 ack=1 win=14480 len=0 mss=1452 sack_perm=1 tsval=758478734 tsecr=3906214190 ws=256 |         |(65430)  <------------------  (443)    | |15.027   |         65430 > https [ack]           |tcp: 65430 > https [ack] seq=1 ack=1 win=132480 len=0 tsval=3906214442 tsecr=758478734 |         |(65430)  ------------------>  (443)    | |15.034   |         client hello                  |tlsv1: client hello |         |(65430)  ------------------>  (443)    | |15.289   |         https > 65430 [ack]           |tcp: https > 65430 [ack] seq=1 ack=124 win=14592 len=0 tsval=758478799 tsecr=3906214448 |         |(65430)  <------------------  (443)    | |15.291   |         server hello, certi           |tlsv1: server hello, certificate, server hello done |         |(65430)  <------------------  (443)    | |15.291   |         65430 > https [ack]           |tcp: 65430 > https [ack] seq=124 ack=1386 win=131088 len=0 tsval=3906214696 tsecr=758478799 |         |(65430)  ------------------>  (443)    | |17.207   |         client key exchange           |tlsv1: client key exchange, change cipher spec, encrypted handshake message |         |(65430)  ------------------>  (443)    | |17.505   |         encrypted handshake           |tlsv1: encrypted handshake message, change cipher spec, encrypted handshake message |         |(65430)  <------------------  (443)    | |17.505   |         client hello                  |tlsv1: client hello |         |(65430)  ------------------>  (443)    | |17.507   |         65430 > https [fin,           |tcp: 65430 > https [fin, ack] seq=557 ack=1636 win=130832 len=0 tsval=3906216837 tsecr=758479353 |         |(65430)  ------------------>  (443)    | |17.776   |         encrypted alert               |tlsv1: encrypted alert |         |(65430)  <------------------  (443)    | |17.776   |         65430 > https [rst]           |tcp: 65430 > https [rst] seq=557 win=0 len=0 |         |(65430)  ------------------>  (443)    | |17.777   |         encrypted alert               |tlsv1: encrypted alert |         |(65430)  <------------------  (443)    | |17.777   |         https > 65430 [fin,           |tcp: https > 65430 [fin, ack] seq=1682 ack=557 win=15616 len=0 tsval=758479421 tsecr=3906216836 |         |(65430)  <------------------  (443)    | |17.777   |         https > 65430 [ack]           |tcp: https > 65430 [ack] seq=1683 ack=558 win=15616 len=0 tsval=758479421 tsecr=3906216837 |         |(65430)  <------------------  (443)    | |17.777   |         65430 > https [rst]           |tcp: 65430 > https [rst] seq=557 win=0 len=0 |         |(65430)  ------------------>  (443)    | |17.777   |         65430 > https [rst]           |tcp: 65430 > https [rst] seq=557 win=0 len=0 |         |(65430)  ------------------>  (443)    | |17.777   |         65430 > https [rst]           |tcp: 65430 > https [rst] seq=558 win=0 len=0 |         |(65430)  ------------------>  (443)    | 

from callflow above, seems client , server fail complete succesful negotiation, have no idea why.

any suggestions on how resolve problem welcome. believe issue exists on client side (android app using restlet 2.0.15 framework), not on app code (since works fine when using http) rather on ssl negotiation/handshake before making calls. believe certificate authority (comodo) accepted/trusted android (i've done https calls through android device browser), still gives certificate warning need accept before continuing. restlet 2.0.15 not handling smoothly ssl communication, , need upgrade 2.1 or later?

looking forward hearing suggestions. in case you'd more info help, ask me. :)

thanks in advance, alex

========= update =========

ok, suspecting. problem certificate (having cname = www .mydomain. com, being loaded https:// mywebservice. elasticbeanstalk. com) seems android client invalid, doesn't send get/post request server.

i realized when send post method terminal (using "curl"), ignoring ssl verification warnings (-k option). time secure connection responded expected, sending json reply.

based on google's own android documentation suggestion, tried alter hostnameverifier method in order past certification validation. how clientresource created:

public static clientresource createclientresource(string resourceuri) {     reference reference = new reference(resourceuri);     system.setproperty("ssl.trustmanagerfactory.algorithm",javax.net.ssl.keymanagerfactory.getdefaultalgorithm());      org.restlet.context context = new org.restlet.context();     context.getattributes().put("hostnameverifier", new hostnameverifier() {                      @override                     public boolean verify(string arg0, sslsession arg1) {                             return true;                      }              });      clientresource resource = new clientresource(context, reference);      engine.getinstance().getregisteredclients().clear();     engine.getinstance().getregisteredclients().add(new httpclienthelper(null));     engine.getinstance().getregisteredconverters().add(0, new jacksonconverter());      resource.release();      return resource; } 

but doesn't work either, still 1001 recoverable error. still, android client can't past "invalid" request.

i'd appreciate suggestions. :)

i managed solve problem. after checking "response" object, , more response status, exception raised error:

communication error (1001) - connector failed complete communication server javax.net.ssl.sslhandshakeexception: java.security.cert.certpathvalidatorexception: trust anchor  certification path not found. 

this made me re-investigate uploaded certificates on aws, , problem. seems hadn't installed certificate chain (intermediate certificates) correctly on aws ec2 instance. certificate chain of ca consists of 4 certificate files, , aws needs chain in specific order (signing certificate first, ca root certificate last, , other certificates in between), given in pem/text format.

after correcting certificate chain, worked charm. :)