Android app rejected because of old OpenSSL

[tgom]

The Google Play Team rejected my apk for violating their Malicious Behavior or User Data policy. They imply that the included OpenSSL is old and the vulnerabilities were addressed in OpenSSL 1.0.2f/1.0.1r.

My apk was built with Flash CS6 on a PC, using embed Air 18.0.0.144 SDK.

What is the simplest method for me to solve this problem?

[kglad]

did you use OpenSSL to add your public key to your signing certificate?  if not:

the simplest is to update your air sdk (help>manage adobe air sdk), Find and download archived versions of Adobe AIR SDK

if you're using a self-signed p12 certificate you may need to create a new one, but i don't think that's the problem.  first create a new apk using the latest sdk and see if that's accepted.

[tgom]

Thanks kglad.com . I'll try that. However, your link goes to a 404.

[kglad]

i just click it and was linked to the correct page,

http://helpx.adobe.com/air/kb/archived-air-sdk-version.html

[tgom]

It also works for me now.

Do I choose Adobe AIR 25.0.0.134 Windows (10 MB)?

[kglad]

yes, you want the latest version but you want the sdk, not the runtime.  you'll extract that compressed file into a folder and then you'll navigate to that folder from flash to add that sdk so you can publish with it.

[tgom]

I installed the 25.0.0.134 sdk into Flash CS6 and publish gave the following error:

"Error creating files.  dx tool failed. Could not create the Java virtual machine."

[kglad]

do you have kasperky antivirus?

[tgom]

No. I have malwarebytes.

[kglad]

suspend your av and retry publishing.

if you see another jvm error, are you offered the option to edit jvm.ini in the error message?

[tgom]

Exact same error message with OK as the only option.

[kglad]

open C:\Program Files (x86)\Adobe\Adobe Flash CS6\Common\First Run\ActionScript 3.0\jvm.ini in flash and change the line

-Xmx128m

to

-Xmx1024m

and save.  close flash cs6 and reopen and retry publishing.

[tgom]

Folder C:\Program Files (x86)\Adobe\Adobe Flash CS6 does not exist on my computer.

[Colin Holgate]

Try: C:\Program Files\Adobe\Adobe Flash CS6\Common\First Run\ActionScript 3.0\jvm.ini

[tgom]

Folder C:\Program Files\Adobe\Adobe Flash CS6 does not exist on my computer.

[tgom]

I searched and found jvm.ini in C:\Program Files\Adobe\Adobe Animate CC 2015.2\Common\First Run\ActionScript 3.0.

[Colin Holgate]

If it's Animate CC 2015.2 that you're using, and not Flash Pro CS6, then yes, that would be the right folder.

Make sure you quit Animate and open it again after changing the text to be -Xmx1024m in that file.

[tgom]

This project started some time ago in Flash CS6. I recently subscribed to CC. I ran into some problems trying to move the project to CC, and so I decided to finish it in CS6.

Animate's jvm.ini is:

-Djava.awt.headless=true

-Xmx256m

Under the circumstances, would changing it possibly solve my problem in CS6 or could it cause problems in Animate down the road?

[Colin Holgate]

I see that on Mac the matching folder is named Flash CS6, and not Adobe Flash CS6. Perhaps you have a folder:

C:\Program Files\Adobe\Flash CS6\

If you do, that's where you would go to edit the file for CS6. Editing the one for Animate won't help CS6 at all, but it may help Animate enough that you could finish the project in Animate instead of CS6.

If you go into C:\Program Files\ and do a search for jvm.ini, any that are in any subfolder should show up in the list. Hopefully then you'll find the one that CS6 uses.

[tgom]

I searched my computer (PC Win7) to find jvm.ini in both:

C:\Users\Belna\AppData\Local\Adobe\Flash CS6\en_US\Configuration\ActionScript 3.0

-Djava.awt.headless=true

-Xmx256m

and

E:\Creative Cloud\ Creative Cloud Files\Adobe Flash CS6\Common\First Run\ActionScript 3.0

-Djava.awt.headless=true

-Xmx128m

What do you suggest?

[kglad]

change both of them.

[Colin Holgate]

That's interesting. Seems like your drive has two partitions that can both have applications installed on them.

As kglad said, change both of them, and in both cases make it be -Xmx1024m.

[tgom]

Made both changes. Same error. Rebooted. Same error.

[Colin Holgate]

Is this a new app or an update to an existing app? If it's a new app, try making a new certificate. You do that in AIR for Android Settings, in the Deployment tab, by clicking on the Create button. When you are making a certificate you have a choice of Type, where you can use 1024-RSA or 2048-RSA.

A while ago Google started requiring 2048 bit, and if your project is old enough you may have made a 1024 bit one, which Google would then reject. With a new certificate that is 2048-RSA that would be one less thing for Google to reject.

[tgom]

Made a new certificate for 2048-RSA. Same error.