How to trust self signed certificate on Android?

Question

I have generated self signed certificate for my server. Then added it to Android with Settings -> Security -> Install.

When I'm trying to connect to my server from the application I'm getting error:

java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

As I understand after I've added certificate to list of trusted ones it should work fine. Am I missing something? The idea is to add certificate through Android system without modifying application code.

Btw I'm using OkHttpClient for network connection. Maybe I should enable something for https connection?

Solution

It is important to Android that when you generate your self-signed certificate, you mark it as a Certificate Authority in order to empower it to certify certificates — even if only to sign itself and so certify that it is itself.

This is done in the basicConstraints extension, declaring CA:TRUE instead of the default CA:FALSE. When you import a certificate so marked, Android will consider it a user-installed root certificate, and you should be able to see it under Credential storage → Trusted credentials → USER.

However, a certificate having this bit is a mighty power, and such certificates have been used by nefarious tools to spy on supposedly encrypted user communication in the past. Accordingly, these days, Google Play Protect will want to have a word with the user when this kind of CA certificate is in force.

Comments

[eckes]

Do you know whether this has changed with Android 9? I know that I had this working in the past (after setting CA:TRUE) but with Android 9, I can't get it running anymore...