Android 7.0 can't establish ssl connection

That server is using a P-384, elliptic curve certificate, which Android 7.0 doesn't support.

As least according to @Nummer378 in another thread:

Android 7.0 has a bug, where the only supported elliptic curve is P-256 , meaning that the P-384 curve used by Let's Encrypts E1/X2 certs cannot be handled by this Android version. The Android version advises ECC support though, so I presume that this scenario will simply break (handshakes usually fail with "illegal parameter" TLS alert from my tests). 7.1 is fixed though, this seems to only affect 7.0. Older than 7.0 (e.g 6.x and below) as well as 7.1 and newer works fine.

So you need to use the P-256 elliptic curve (at least as long as it's still signed by the RSA intermediate, as that is supposed to change eventually to be signed by a P-384 intermediate that will break on Android 7.0 anyway), so stick with RSA if you need to support older android versions.

(And once again, @Nummer378 is faster than I.)

2 Likes