Question

I have two mobile applications, which access my site https://example.com from inside. Recently, I have prolonged certificate for one year and replaced it on nginx’ config.

Now web browsers open site well, iOS application opens site well, but Android application doesn’t open it saying

Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

with the code

    myUrl = URL("https://example.com")
    try {
        conn = myUrl.openConnection() as HttpsURLConnection
        conn.readTimeout = 10000
        conn.connectTimeout = 15000
        conn.requestMethod = "POST"
        conn.doInput = true
        conn.doOutput = true
        conn.setChunkedStreamingMode(0)


        val postData = URLEncoder.encode(...

        val os = conn.outputStream

What it wants and how to fix?

Reinstall doesn’t help. Running under debugger shows this error.

Did you try to install fresh app? Probably the cached certificate is still the old one. — Mohit Ajwani, Jun 21, 2021 at 9:45
Reinstall for all users? Why iOS app didn’t need reinstall? — Dims, Jun 21, 2021 at 10:49
Where do you got the certificate from that you use on your website (Let’s Encrypt?)? How old is the Android device you use for testing? I recommend checking your web site for TLS problems: ssllabs.com/ssltest/analyze.html — Robert, Jun 21, 2021 at 15:27
@Robert how to stop it? It is constantly re-running tests and not allowing me to see reports? — Dims, Jun 21, 2021 at 17:04
Wait for the test to complete. This takes some minutes (up to 5 minute for each IP) — Robert, Jun 21, 2021 at 18:30

score 0 · Accepted Answer · 2021-06-22T10:37:32

It was a problem with certificate on my site, not in the application. By some reason, only Android application was sesitive to this problem. iOS application and all web browsers were reporting certificate is ok. SSL check sites like digicert.com were reporting chain problems.

What I did is I took this file pointed by nginx

ssl_certificate /etc/ssl/certs/my_certificate.crt;

which had only one certificate inside and then pasted two other certificates from my provider. These additional certificates were entitled “root” and “intermediate”.

After that problem was gone.

1 Answer