title: SSLProtocolException with HTTPs on Retrofit2
body: <p>I am running into an issue on Android 4.4 phones (specifically, Galaxy S4, although I believe it's not the fault of the phone itself). While using Retrofit2.Http I receive the following error while connecting on HTTPS:</p>
  
  <pre><code>javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x737510d0: Failure in SSL library, usually a protocol error
  error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure (external/openssl/ssl/s23_clnt.c:741 0x727fb7d0:0x00000000)
  </code></pre>
  
  <p>I have found several resources that indicate this is a bug on Android 4.4(1), but the examples given always assume use of the HttpsUrlConnection class, which I am not using.</p>
  
  <p>I did find some answers here about setting specific ConnectionSpec instances for the connection, which seemed promising because it was Retrofit-specific(2). Unfortunately, this made no difference in the error. An example of my code (I tried both MODERN_TLS and COMPATIBLE_TLS):</p>
  
  <pre><code>return new OkHttpClient.Builder()
                  .addInterceptor(interceptor)
                  .connectionSpecs(Collections.singletonList(ConnectionSpec.MODERN_TLS))
                  .build();
  </code></pre>
  
  <p>Switching to "http" does work, but that is not an option for the final release. A secure, encrypted connection is absolutely required, so any solution that completely disables HTTPS or blindly accepts any certificate is not likely to be acceptable.</p>
  
  <p>Thanks in advance!</p>
  
  <p>(1) <a href="https://stackoverflow.com/questions/29916962/javax-net-ssl-sslhandshakeexception-javax-net-ssl-sslprotocolexception-ssl-han">Javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: Failure in SSL library, usually a protocol error</a></p>
  
  <p>(2) <a href="https://stackoverflow.com/questions/33353251/retrofit-okhttp-sslhandshakeexception">Retrofit OkHttp SSLHandshakeException</a></p>
  
  <h2>Edit:</h2>
  
  <p>Running openssl gives the following:</p>
  
  <pre><code>[[my_computer]]$ ./openssl s_client -connect [[server_hidden_by_me]]:443 -tls1
  
  
  CONNECTED(00000003)
  depth=2 /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
  verify error:num=20:unable to get local issuer certificate
  verify return:0
  ---
  Certificate chain
   0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=[hidden_by_me]
     i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
   1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
     i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
     i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
  ---
  Server certificate
  -----BEGIN CERTIFICATE-----
  [snip certificate for brevity]
  -----END CERTIFICATE-----
  subject=/OU=Domain Control Validated/OU=PositiveSSL/CN=[hidden_by_me]
  issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 5449 bytes and written 426 bytes
  ---
  New, TLSv1/SSLv3, Cipher is DHE-RSA-SEED-SHA
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : DHE-RSA-SEED-SHA
      Session-ID: A4D84E2A0A16DB03082172695141BE1BB562F920ED4E4F6A9139733D9CAB7A54
      Session-ID-ctx: 
      Master-Key: 119C10E5CC34297D1717E4AEAB8BF1CAA8BA012C125B10513FBFE0854B6AB0E9E65536F801990CA3C992FEB69ADBE279
      Key-Arg   : None
      TLS session ticket lifetime hint: 300 (seconds)
      TLS session ticket:
      0000 - 5c 21 2c ac 68 a9 ef 71-8c 69 2a 86 0c da 6c cd   \!,.h..q.i*...l.
      [snipped for brevity]
  
      Start Time: 1464109807
      Timeout   : 7200 (sec)
      Verify return code: 0 (ok)
  ---
  </code></pre>