Appcenter-sdk-dotnet: SDK communications with unsecure server in.appcenter.ms (TLS 1.0)

Created on 13 Apr 2018 · 3Comments · Source: microsoft/appcenter-sdk-dotnet

Description

The SDK communicates with a domain that supports TLS 1.0. TLS 1.0 is no longer considered secure and after a security review of our mobile application, we have been told that our app cannot speak to any domains that support TLS 1.0.

Repro Steps

Use the SDK and observe that it communicates to in.appcenter.ms.
Use a website like ssl labs to check supported TLS versions. https://www.ssllabs.com/ssltest/analyze.html?d=in.appcenter.ms&latest

I've removed the details questions since they are irrelevant.

bug

Source

MisterJimson

Most helpful comment

Version 1.7.0 enabled TLS 1.2 on API level 16+ instead of 20+.

On the current version of the SDK, only devices with API level 15 are still using TLS 1.0.

Next version (1.10.0) will drop support for API level 15 and TLS 1.2 will be enforced server side soon.

guperrot on 30 Aug 2018

❤2

All 3 comments

Hi @MisterJimson,

Thx for getting in touch. If TLS 1.2 is available on a device, we will use that. Our Android SDK supports Android versions < 4.4. Those devices don't support TLS 1.2, so we have 1.0 around for backward compatibility only.