"Trust anchor for certification path not found"
Android throws this (java.security.cert.CertPathValidatorException) when the server certificate is signed by a CA missing from the Android system truststore. Three causes: (1) self-signed or private CA, (2) incomplete chain — server doesn't send the intermediate, (3) old Android < 7 doesn't know newer CAs (Let's Encrypt R3 since 2021). Fix: install the full chain on the server or add the CA to network_security_config.xml.
Below: details, example, related, FAQ.
Details
- Chain check: openssl s_client -connect host:443 -showcerts — should show 2+ certs
- Android 7+ supports Let's Encrypt. Android < 7 — needs ISRG Root X1 cross-signed
- network_security_config.xml — per-app trust config (API 24+)
- Does not work with Google Play — apps use certificate pinning
- Alternative: apps using OkHttp with a custom TrustManager
Example
<!-- res/xml/network_security_config.xml -->
<network-security-config>
<base-config>
<trust-anchors>
<certificates src="system"/>
<certificates src="@raw/my_ca"/> <!-- res/raw/my_ca.pem -->
</trust-anchors>
</base-config>
</network-security-config>
<!-- AndroidManifest.xml -->
<application android:networkSecurityConfig="@xml/network_security_config" ...>Related
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeFrequently Asked Questions
Quick way to check the chain?
curl -v https://host 2>&1 | grep -i "issuer\|depth\|ssl". Or enterno.io/ssl — shows intermediate + leaf.
LE on Android < 7?
ISRG Root X1 cross-signed via DST Root CA X3. Expired 30 Sep 2021, LE resumed cross-sign — works until 2025+.
App-level vs system-level?
network_security_config — per-app (API 24+). Device-wide — needs rooted device + push CA to /system/etc/security/cacerts/.