SSLHandshakeException Trust anchor for certification path not found Android HTTPS

java android ssl https openssl

38,295

Updates:

I've never been an expert at this matter, the following is only a workaround and might not be secure, use it at your own risk
This post is 3+ years old, so it may be outdated by now (code will not compile) but you should find be able to find the updated approach or official docs saying certain parts are deprecated or removed

Thank noloader for pointing me in the correction direction. I solved my issue using the following:

String keyStoreType = KeyStore.getDefaultType();
            KeyStore keyStore = KeyStore.getInstance(keyStoreType);
            keyStore.load(null, null);
            keyStore.setCertificateEntry("ca", ca);// my question shows how to get 'ca'
TrustManagerFactory tmf = TrustManagerFactory.getInstance(
    TrustManagerFactory.getDefaultAlgorithm());
// Initialise the TMF as you normally would, for example:
tmf.init(ca); 

TrustManager[] trustManagers = tmf.getTrustManagers();
final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0];

TrustManager[] wrappedTrustManagers = new TrustManager[]{
   new X509TrustManager() {
       public java.security.cert.X509Certificate[] getAcceptedIssuers() {
          return origTrustmanager.getAcceptedIssuers();
       }

       public void checkClientTrusted(X509Certificate[] certs, String authType) {
           origTrustmanager.checkClientTrusted(certs, authType);
       }

       public void checkServerTrusted(X509Certificate[] certs, String authType) {
           try {
               origTrustmanager.checkServerTrusted(certs, authType);
           } catch (CertificateExpiredException e) {
               // Do what you need to do, log to Crashlytics?
           }
       }
   }
};

SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, wrappedTrustManagers, null);
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

Out of the 3 certificates found for the site, mentioned in my question, the one that worked for me was the VeriSign Class 3 Secure Server CA - G3

38,295

Author by

ericn

Engineer, walker, biker

Updated on September 04, 2020

Comments

ericn over 3 years

I'm trying to establish a connection to a HTTPS site and I got this exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
My original code is as follows:

URL url = new URL("https://example.com");
            HttpsURLConnection urlConnection =
                (HttpsURLConnection)url.openConnection();
            in = urlConnection.getInputStream();
            byte[] responsedata = CommonUtil.readInputStream(in);
            Log.w(TAG, "response is "+CommonUtil.convertBytesToHexString(responsedata));

Then, I read Google's article here and modified my code to:

CertificateFactory cf;
        try {
            cf = CertificateFactory.getInstance("X.509");
            InputStream in = this.mContext.getResources().openRawResource(R.raw.cert);
            Certificate ca;
            ca = cf.generateCertificate(in);
                System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
                in.close();
                URL url = new URL("https://example.com");
                HttpsURLConnection urlConnection =
                (HttpsURLConnection)url.openConnection();
                in = urlConnection.getInputStream();
                byte[] responsedata = CommonUtil.readInputStream(in);
            Log.w(TAG, "response is "+CommonUtil.convertBytesToHexString(responsedata));
            in.close();

Regarding the R.raw.cert file, I use this site to check the certificates of the site. I found 3 cetificates and I have no idea which one to use. I tried them one by one.
The one name "VeriSign Class 3 Public Primary Certification Authority - G5" results in the following exceptions:

01-17 17:46:54.759: E/Process(8764): java.security.cert.CertificateException: org.apache.harmony.xnet.provider.jsse.OpenSSLX509CertificateFactory$ParsingException: org.apache.harmony.xnet.provider.jsse.OpenSSLX509CertificateFactory$ParsingException: java.lang.RuntimeException: error:0906D06C:PEM routines:PEM_read_bio:no start line

When I use the one named "VeriSign Class 3 Secure Server CA - G3" or the one with the name "example.com" (same as the site name) I got the same SSLHandshakeException.

What do I need to do?

At the same time, Symatec SSL Toolbox shows me an error and 1 recommendation which I don't understand:

Intermediate certificate missing.
VeriSign Class 3 Secure Server CA - G3

Update your certificate chain.
Your certificate chain is valid, but some older browsers may not recognize it. To support older browsers, download and install the missing intermediate certificate

The 3 certificates found for the site are as follows:
example.com:

VeriSign Class 3 Secure Server CA - G3

VeriSign Class 3 Public Primary Certification Authority - G5:

IgorGanapolsky over 8 years

You did this on the client-side, or server-side?
ericn over 8 years

this was done on client side, Android code @IgorGanapolsky
Muhammad Babar over 7 years

I'm getting this java.io.IOException: Hostname someHostName was not verified any idea?
luiscosta over 7 years

This is not even a solution. If you get a CertificateExpiredException it will be silent and it will connect to the server anyways. This makes an attack by man in the middle possible.
Nohus almost 7 years

tmf.init(ca); you cannot initialize a TrustManagerFactory with a Certificate, this code doesn't even compile, and if it would it makes SSL pointlessly insecure like @luiscosta noted.