title: javax.crypto.AEADBadTagException: Tag mismatch
body: <p>I am trying to fix AEADBadTagException: Tag mismatch coming intermittently from a third party API (stack trace below). I am using retrofit version 2.2.0</p>
  
  <pre><code>"javax.crypto.AEADBadTagException: Tag mismatch!",
   "at c.s.c.p.GaloisCounterMode.decryptFinal(GaloisCounterMode.java:524)", 
  "at c.s.c.p.CipherCore.finalNoPadding(CipherCore.java:1023)", 
  "... 2 frames excluded", 
  "at javax.crypto.Cipher.doFinal(Cipher.java:2377)", 
  "at s.s.ssl.CipherBox.decrypt(CipherBox.java:461)", 
  "at s.s.ssl.InputRecord.decrypt(InputRecord.java:172)", 
  "at s.s.s.SSLSocketImpl.readRecord(SSLSocketImpl.java:1015)",
   "... 90 common frames omitted", 
  "Wrapped by: j.n.ssl.SSLException: Tag mismatch!",
   "at s.s.ssl.Alerts.getSSLException(Alerts.java:208)",
   "at s.s.s.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)",
   "at s.s.s.SSLSocketImpl.readRecord(SSLSocketImpl.java:1020)", 
  "at s.s.s.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:930)", 
  "at s.s.s.AppInputStream.read(AppInputStream.java:105)", 
  "at okio.Okio$2.read(Okio.java:138)", 
  "at okio.AsyncTimeout$2.read(AsyncTimeout.java:236)",
  "at o.RealBufferedSource.request(RealBufferedSource.java:66)", 
  "at o.RealBufferedSource.require(RealBufferedSource.java:59)", 
  "at o.RealBufferedSource.readHexadecimalUnsignedLong(RealBufferedSource.java:284)", 
  "at o.i.h.Http1Codec$ChunkedSource.readChunkSize(Http1Codec.java:444)", "at o.i.h.Http1Codec$ChunkedSource.read(Http1Codec.java:425)", 
  "at o.RealBufferedSource.request(RealBufferedSource.java:66)", 
  "at o.l.HttpLoggingInterceptor.intercept(HttpLoggingInterceptor.java:238)", 
  "at o.i.h.RealInterceptorChain.proceed(RealInterceptorChain.java:92)", "at o.i.h.RealInterceptorChain.proceed(RealInterceptorChain.java:67)", 
  "at c.i.t.c.ClientConfiguration.lambda$irctcClient$48(ClientConfiguration.java:77)", 
  "at o.i.h.RealInterceptorChain.proceed(RealInterceptorChain.java:92)", "at o.i.h.RealInterceptorChain.proceed(RealInterceptorChain.java:67)", 
  "at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:179)", 
  "... 73 frames truncated"
  </code></pre>
  
  <p>Going through the stack trace and stackoverflow, it seems the problem is with the API response from the 3rd party while parsing through core java libraries and has nothing to do with retrofit and OkHttp. However, on replacing retrofit with spring rest template, these exceptions have stopped completely. It seems OkHttp/retrofit is making some hard checks on the response which are not present in rest template by default.</p>
  
  <p>What could be the reason behind this? Is there a configuration I'm missing here ? I've already tried creating unsafe okhttp client by creating trustManager which does not validate certificate chains but it was also of no use.</p>
  
  <p>Please guide me on this.</p>