move elliptic curves workaround to the top...
@@ -220,6 +220,16 @@ public class HttpClientFactory {
builder.sslSocketFactory(sf, trustManager);
List<ConnectionSpec> connectionSpecs = new ArrayList<ConnectionSpec>();
+
+ if (ellipticCurvesWorkaround) {
+ // fallback for Bug in Android 7.0 where only elliptic curve prime256v1 can
+ // be used -> retry with a cipher suite without elliptic curves
+ connectionSpecs.add(new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
+ .cipherSuites(CipherSuite.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
+ CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256)
+ .build());
+ }
+
connectionSpecs.add(ConnectionSpec.MODERN_TLS);
connectionSpecs.add(new ConnectionSpec.Builder(ConnectionSpec.COMPATIBLE_TLS)
.allEnabledCipherSuites()
@@ -236,15 +246,6 @@ public class HttpClientFactory {
.build());
}
- if (ellipticCurvesWorkaround) {
- // fallback for Bug in Android 7.0 where only elliptic curve prime256v1 can
- // be used -> retry with a cipher suite without elliptic curves
- connectionSpecs.add(new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
- .cipherSuites(CipherSuite.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
- CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256)
- .build());
- }
-
connectionSpecs.add(ConnectionSpec.CLEARTEXT);
builder.connectionSpecs(connectionSpecs);
