I'm developing an Android App which sends some HTTPS requests to our own Webserver (Linux, Nginx, SSL zertificate from "Let's Encrypt").
The requests worked fine on my test devices (Android 4.2.2 & Android 6.0.1), but on another device (5.1.1) the request threw the Exception:
Cannot verify hostname [my_domain]
Looking at the certificate in my browser, it seems to work fine, using the following connection:
TLS 1.2 AES_128_GCM ECDHE_RSA
After searching the web for any help, I finally tried to apply a custom SSLSocketFactory, which forces the client to use the Cipher Suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (which has been used by my other test devices, at which the request worked).
Long story short: The request then did work on any device, which indicates that it's the clients fault that the connection hasn't been successful.
So now to my questions:
Why does the SSL verifying work on some Android devices, but on some not?
Why does the Exception say that the hostname couldn't be verified, while the certificate is valid and the hostname stated in the certificate is the right one?
Is it bad to bind the requests to one specific cipher suite? (Looking at those lists, the given cipher suite should be available on all needed Android devices (4.1.0 and higher))
I'm quite a newby in SSL and am looking forward to any answer that could help me to understand this.