androidtls1.2android-9.0-pie

Android P without TLS: network-security-config: cleartextTrafficPermitted not possible for IP (only domain)

I'm trying to connect to an embedded device with an HTTP-server which works fine on android < P (until I set targetSdkVersion 28) because there was a change that Network TLS enabled by default.

There is a way to Opt out of cleartext traffic but it seems that this is only possible for domains and not IP addresses.

I've tried to set a android:networkSecurityConfig in the Manifest with the IP instead of the domain but this didn't work:

<network-security-config>
  <domain-config cleartextTrafficPermitted="false">
    <domain includeSubdomains="true">172.16.33.1</domain>
  </domain-config>
</network-security-config>

Setting this as a <base-config cleartextTrafficPermitted="false"> does not work either.

So it seems that there is no way to get non-TLS communication working when not having a domain. But because this is an embedded device in the local network we do not have a domain (we only know the IP).

This seems like a major problem for all kind of embedded devices which would not be able to communicate anymore. Plus, "new apps and updates to existing apps require to target API level [28 in November 2020]" (starting in November 2018 with API 26 and advancing each year).

Any ideas how to make this possible?

Solution

  • It's working with <base-config cleartextTrafficPermitted="true"> for IP addresses.

    (Of course it also needs to be true not false).