java.security.cert.CertPathValidatorException: Tru

Question

I'm developing a client app on Android which connects to my server that is on AWS behind a Load balancer, i've created an SSL certificate on GoDaddy and added it on the load balancer.

Everything is going well on the browser, it recognize the certificate, but when I try to call the APIs with Android i got this exception:

09-18 01:18:55.187: W/System.err(32585): Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

I've found some discussion who said to add the certificate on the app, but is there no way to fix it on the certificate server side? is it not an issue with the cert?

Answer 1

I fixed it by creating a new .csr with the right Organizational Unit Name and Common Name

Answer 2

I would say that official Android doc will be your best friend in this situation. See here: http://developer.android.com/training/articles/security-ssl.html#UnknownCa

And this is what they say, which is both solving the issue and very smart at the same time:

In this case, the SSLHandshakeException occurs because you have a CA that isn't trusted by the system. It could be because you have a certificate from a new CA that isn't yet trusted by Android or your app is running on an older version without the CA. More often a CA is unknown because it isn't a public CA, but a private one issued by an organization such as a government, corporation, or education institution for their own use.

Fortunately, you can teach HttpsURLConnection to trust a specific set of CAs. The procedure can be a little convoluted, so below is an example that takes a specific CA from an InputStream, uses it to create a KeyStore, which is then used to create and initialize a TrustManager. A TrustManager is what the system uses to validate certificates from the server and—by creating one from a KeyStore with one or more CAs—those will be the only CAs trusted by that TrustManager.

Given the new TrustManager, the example initializes a new SSLContext which provides an SSLSocketFactory you can use to override the default SSLSocketFactory from HttpsURLConnection. This way the connection will use your CAs for certificate validation.

Answer 3

This bizarre error message means that the trust store you specified was not found.