TLS handshake failure on Android API < 21 with Xamarin.Android HttpClient

Resolution: Use the Managed Handler

To reliably enforce TLS 1.2 on Android API 19 and 20, you must use the managed HttpClientHandler and explicitly set the security protocol before instantiating the client.

1. Set ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12; before any HttpClient is created.
2. Instantiate HttpClient using a new HttpClientHandler (the managed implementation) rather than the AndroidClientHandler.

Explanation of Handler Behavior

AndroidClientHandler (Native)

The AndroidClientHandler wraps java.net.HttpURLConnection. While the Android OS kernel on API 19/20 supports TLS 1.2, the native Java implementation does not enable it by default. Because Xamarin.Android does not provide a supported API to inject a custom SSLContext into this handler, there is no official way to force TLS 1.2 while using the native handler.

Managed HttpClientHandler

The managed handler is a .NET implementation that respects the ServicePointManager.SecurityProtocol setting. On API 19/20, the .NET runtime utilizes the underlying OpenSSL library to negotiate TLS 1.2. This approach is reliable provided you are using Xamarin.Android SDK 9.0 or later.

Implementation

using System.Net;
using System.Net.Http;

// Must be called before HttpClient is instantiated
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

// Explicitly use the managed handler
var handler = new HttpClientHandler();
var client = new HttpClient(handler);

// Request will now negotiate TLS 1.2
var response = await client.GetAsync("https://your-tls12-endpoint.com");

Verification and Assumptions

This solution assumes the use of Xamarin.Android SDK 9.0+. On older SDKs, SecurityProtocol settings may be ignored. To verify the fix:

• Network Capture: Use a tool like Wireshark or Fiddler to confirm the Client Hello specifies TLS 1.2.
• Server Logs: Check the endpoint logs to ensure the connection was established via TLS 1.2 and not downgraded.
• Cross-API Test: Compare behavior against an API 21+ device to ensure consistency.

Diagnostic Detail

If the handshake still fails after implementing the above, please confirm your Xamarin.Android SDK version. If you are on a version prior to 9.0, the managed handler may not correctly honor the SecurityProtocol setting on these specific API levels.