title: HttpClient fails with Handshake Failed in Android 5.0 Lollipop
body: <p>DefaultHttpClient in Android 5.0 Lollipop seems to be broken. It can not set the connection to some sites that were successfully set by previous versions of Android.</p>
  
  <p>For example I try to connect to <a href="https://uralsg.megafon.ru" rel="nofollow noreferrer">https://uralsg.megafon.ru</a></p>
  
  <pre><code>//Create httpclient like in https://stackoverflow.com/questions/18523784/ssl-tls-protocols-and-cipher-suites-with-the-androidhttpclient
  HttpClient client = new DefaultHttpClient(manager, params);
  HttpGet httpGet = new HttpGet("https://uralsg.megafon.ru");
  HttpResponse client = httpclient.execute(httpGet);
  </code></pre>
  
  <p>This code works in Android 2.3-4.4, but fails on Android 5.0 (devices and emulator) with error Connection closed by peer.
  Of course this is understandable because Android 5.0 tries to connect this old server with TLSv1.2 and modern ciphers and it does not support them.</p>
  
  <p>Ok, using the sample code in <a href="https://stackoverflow.com/questions/18523784/ssl-tls-protocols-and-cipher-suites-with-the-androidhttpclient">SSL/TLS protocols and cipher suites with the AndroidHttpClient</a> we limit the protocol and cipher to <em>TLSv1</em> and <em>SSL_RSA_WITH_RC4_128_MD5</em>. Now it fails with a different error: </p>
  
  <pre><code>javax.net.ssl.SSLHandshakeException: Handshake failed
  caused by 
      error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac 
      (external/openssl/ssl/s3_pkt.c:1286 0x7f74c1ef16e0:0x00000003) 
      at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake
  </code></pre>
  
  <p>And of course this code runs smoothly on Android 2.3-4.4.</p>
  
  <p>I examined the traffic with wireshark:</p>
  
  <pre><code>302 4002.147873000  192.168.156.30  83.149.32.13    TLSv1   138 Client Hello
  303 4002.185362000  83.149.32.13    192.168.156.30  TLSv1   133 Server Hello
  304 4002.186700000  83.149.32.13    192.168.156.30  TLSv1   1244    Certificate
  305 4002.186701000  83.149.32.13    192.168.156.30  TLSv1   63  Server Hello Done
  307 4002.188117000  192.168.156.30  83.149.32.13    TLSv1   364 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
  308 4002.240695000  83.149.32.13    192.168.156.30  TLSv1   61  Alert (Level: Fatal, Description: Bad Record MAC)
  </code></pre>
  
  <p>You can see that connection was established but server alerted because it probably could not decode encrypted handshake message.</p>
  
  <p>I didn't manage to connect to <a href="https://uralsg.megafon.ru" rel="nofollow noreferrer">https://uralsg.megafon.ru</a> using HttpClient on Android 5.0. Stock browser does connect it though. Android 2.3-4.4 connects this site in any way without any difficulties.</p>
  
  <p>Is there any way to make it possible for HttpClient to connect such sites? This is only one example, I am sure there are plenty of legacy servers that couldn't be connected by Android 5.0 and HttpClient.</p>