Repository: netty/netty
Issue: Workaround to use Netty 4.1 with TLS on Android

We need to run a gRPC server on Android so we're planning to use Netty for that. Everything seems to work, but we had to change the following:

https://github.com/netty/netty/blob/2b14775446f3f3937ddd6eb6bd7b22686810908f/handler/src/main/java/io/netty/handler/ssl/Conscrypt.java#L59

Because `PlatformDependent.javaVersion() >= 8` won't be true on Android.

Like I've said, things seem to work based on the testing we've done so far, but I wanted to check a couple of things:

- Why `PlatformDependent.javaVersion() >= 8`? What could break if it's `6`? That way we can check those things on Android.
- Would you be open to a PR that changed that expression with something that worked on Android? Like `CAN_INSTANCE_PROVIDER && IS_CONSCRYPT_SSLENGINE != null && (PlatformDependent.isAndroid() || PlatformDependent.javaVersion() >= 8)`

Issue comments:
I think @ejona86 @nmittler did mention that Conscrypt only works on Java8 in general. This may be special for Android tho.. So yep I would be happy to review and merge a PR which special case Android @gnarea 
I think we've been able to run Conscrypt with Java 7. I see Conscrypt itself is building with Java 7 bytecode for OpenJDK. It might have been Java 6 that was the problem child, since that was before SSLParameters.setEndpointIdentificationAlgorithm().

Java version checks on Android tend to be "wrong," since Android is simultaneously Java 6, 7, 8, 9, etc depending on which APIs you care about.
Conscrypt [claims Java 7 support](https://github.com/google/conscrypt#download). Only recent changes were to drop Java 6. Java 6 support [was added in 2017](https://github.com/google/conscrypt/commit/401f1c4645f5ec715516ee9674c662448d115e66).

It looks like [this is the source](https://github.com/netty/netty/commit/c4832cd9d989788f32dc1321d3e4c72bffa3587a) of the java 8 check, which is before the Java 6 support in Conscrypt that I linked to.
Thanks for looking into this @normanmaurer and @ejona86! @sdsantos has put a PR together in #10182.
@gnarea Could you please share a code snippet on how you got TLS to work on a gRPC server using Netty? I would very much appreciate as I'm currently struggling to find the correct approach.

I'm currently trying to use the `JdkSslContext`.
Hi @jnorkus! Check this out: https://github.com/relaycorp/relaynet-courier-android/blob/d686bb2768470fa139fa64ef3bb9697519160cee/app/src/main/java/tech/relaycorp/cogrpc/server/CogRPCServer.kt#L52
Could you share the code for your Netty-based server on Android? Thank you!

Pull request review comments:

Patch that resolved the issue:
diff --git a/handler/src/main/java/io/netty/handler/ssl/Conscrypt.java b/handler/src/main/java/io/netty/handler/ssl/Conscrypt.java
index 9c9e2bba62c..c4c9182c41a 100644
--- a/handler/src/main/java/io/netty/handler/ssl/Conscrypt.java
+++ b/handler/src/main/java/io/netty/handler/ssl/Conscrypt.java
@@ -56,7 +56,8 @@ private static boolean canInstanceProvider() {
      * Indicates whether or not conscrypt is available on the current system.
      */
     static boolean isAvailable() {
-        return CAN_INSTANCE_PROVIDER && IS_CONSCRYPT_SSLENGINE != null && PlatformDependent.javaVersion() >= 8;
+        return CAN_INSTANCE_PROVIDER && IS_CONSCRYPT_SSLENGINE != null &&
+            (PlatformDependent.javaVersion() >= 8 || PlatformDependent.isAndroid());
     }
 
     static boolean isEngineSupported(SSLEngine engine) {


Test patch: