android - Proguard、HttpClient、および SSLPeerUnverifiedException

Question

アプリで ProGuard を使用したいと考えています。org.apache.http.impl.client.DefaultHttpClient を使用してサーバーにリクエストを送信します。Proguard がなくても問題なく動作しますが、ProGuard をオンにするとアプリをビルドできますが、実行時にアプリを実行すると、次の例外が発生しました。

javax.net.ssl.SSLPeerUnverifiedException No peer certificate
    at com.android.org.conscrypt.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java146)
    at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java93)
    at org.apache.http.conn.ssl.SSLSocketFactory.createSocket(SSLSocketFactory.java388)
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java165)
    at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java164)
    at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java119)
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java360)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java555)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java487)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java465)
    at com.newrelic.agent.android.instrumentation.HttpInstrumentation.execute(HttpInstrumentation.java165)
    at com.abc.communication.CommunicationManager.sendRequest(CommunicationManager.java765)
    at com.abc.communication.CommunicationManager.sendPingRequest(CommunicationManager.java616)
    at com.abc.communication.CommunicationManager.access$100(CommunicationManager.java94)
    at com.abc.communication.CommunicationManager$1.run(CommunicationManager.java190)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java1112)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java587)
    at java.lang.Thread.run(Thread.java841)

どこに問題があるのか​​理解できません。縮小と最適化を無効にしましたが、役に立ちませんでした。また、圧縮オプションのみを有効にしようとしました。つまり、難読化と最適化を無効にしましたが、それも役に立ちませんでした。

アプリをビルドするには、maven を使用します。私のpomファイルの一部：

<plugin>
    <groupId>com.jayway.maven.plugins.android.generation2</groupId>
    <artifactId>android-maven-plugin</artifactId>
    <version>3.8.1</version>

    <dependencies>
        <dependency>
        <groupId>net.sf.proguard</groupId>
        <artifactId>proguard-base</artifactId>
        <version>5.2.1</version>
        </dependency>
    </dependencies>

    <configuration>
        <release>true</release>
        <sdk>
            <platform>22</platform>
        </sdk>
        <undeployBeforeDeploy>false</undeployBeforeDeploy>

        ...

        <proguard>
            <skip>false</skip>
            <config>proguard.cfg</config>
            <configs>
                <config>proguard-android.txt</config>
            </configs>
            <outputDirectory>proguard-files</outputDirectory>
            <filterMavenDescriptor>true</filterMavenDescriptor>
            <filterManifest>true</filterManifest>
        </proguard>
    </configuration>
    <extensions>true</extensions>
</plugin>

proguard-android.txt は、SDK フォルダーの標準ファイルです。

# This is a configuration file for ProGuard.
# http://proguard.sourceforge.net/index.html#manual/usage.html

-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-verbose

# Optimization is turned off by default. Dex does not like code run
# through the ProGuard optimize and preverify steps (and performs some
# of these optimizations on its own).
-dontoptimize
-dontpreverify
# Note that if you want to enable optimization, you cannot just
# include optimization flags in your own project configuration file;
# instead you will need to point to the
# "proguard-android-optimize.txt" file instead of this one from your
# project.properties file.

-keepattributes *Annotation*
-keep public class com.google.vending.licensing.ILicensingService
-keep public class com.android.vending.licensing.ILicensingService

# For native methods, see http://proguard.sourceforge.net/manual/examples.html#native
-keepclasseswithmembernames class * {
    native <methods>;
}

# keep setters in Views so that animations can still work.
# see http://proguard.sourceforge.net/manual/examples.html#beans
-keepclassmembers public class * extends android.view.View {
   void set*(***);
   *** get*();
}

# We want to keep methods in Activity that could be used in the XML attribute onClick
-keepclassmembers class * extends android.app.Activity {
   public void *(android.view.View);
}

# For enumeration classes, see http://proguard.sourceforge.net/manual/examples.html#enumerations
-keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf(java.lang.String);
}

-keep class * implements android.os.Parcelable {
  public static final android.os.Parcelable$Creator *;
}

-keepclassmembers class **.R$* {
    public static <fields>;
}

# The support library contains references to newer platform versions.
# Don't warn about those in case this app is linking against an older
# platform version.  We know about them, and they are safe.
-dontwarn android.support.**

私のproguard.cfgファイル：

-keep public class * extends android.app.Activity

-keep public class * extends android.app.Application

-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver

-keepclasseswithmembers class * {
    public <init>(android.content.Context, android.util.AttributeSet);
}

-keepclasseswithmembers class * {
    public <init>(android.content.Context, android.util.AttributeSet, int);
}

-keep class com.newrelic.** { *; }
-dontwarn com.newrelic.**
-keepattributes Exceptions, Signature, InnerClasses

-keep public class javax.net.ssl.**
-keepclassmembers public class javax.net.ssl.** { *; }

-keep class org.spongycastle.* { *; }
-dontwarn org.spongycastle.*

-keep class org.apache.http.** { *; }
-keepclassmembers public class org.apache.http.** { *; }
-dontwarn org.apache.http.**
-keep class com.abc.communication.CommunicationManager { *; }
-keep class com.abc.communication.CommunicationManager$* { *; }

-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod