Secure WebSocket with valid Namecheap Certificate - CertPathValidatorException: Trust anchor for certification path not found

Question

I bought a valid wildcard certificate from namecheap.com for my domain neelo.de. Now I try to connect via WSS from Android and I always get "javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.". But I can't know why. The certificate is not self signed and I read the docs from google at: https://developer.android.com/training/articles/security-ssl.html

But these problems should only invoke with self signed certificates. I try it with nodejs and it works fine:

WebSocket = require "ws"
ws = new WebSocket("wws://api.neelo.de")

ws.on "open", -> console.log "OPEN"
ws.on "close", -> console.log "CLOSE"
ws.on "error", (err) -> console.log err
ws.on "message", (data) -> console.log data

Here is my android code for loading the keystore:

public WebSocketClient(Context context) throws Exception {
    super(new URI("wss://api.neelo.de"), new Draft_76());
    this.context = context;
    this.messageReceiver = messageReceiver;
    configureKeyStore();
  }

  void configureKeyStore() throws Exception {
    Log.d(TAG, "Configure key store");

    KeyStore ks = KeyStore.getInstance(STORE_TYPE);
    InputStream in = getContext().getResources().openRawResource(R.raw.android_keystore);

    ks.load(in, STORE_PASSWORD.toCharArray());
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    kmf.init(ks, STORE_PASSWORD.toCharArray());
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(ks);

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

    SSLSocketFactory factory = sslContext.getSocketFactory();

    super.setSocket(factory.createSocket());
    }

Anybody an idea? Thanks for help! This problem has already cost me 3 days...

jww jww · Accepted Answer · 2015-02-18T02:29:53

Now I try to connect via WSS from Android and I always get javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

I believe you have three choices.

First, install the root used by Namecheap on your Android device. Unfortunately, I can't find the download page for their root ca. Are they reselling another's warez?

Second, use a wild card certificate from a CA that has a root preinstalled. For this, I'd recommend Startcom. Their CA is preinstalled and trusted by most mobile and desktop browsers. I recommend them because they offer free Class 1 certificates (they charge for revocation, if needed).

Third, use a custom trust store. See, for example, Using a Custom Certificate Trust Store on Android.

Secure WebSocket with valid Namecheap Certificate - CertPathValidatorException: Trust anchor for certification path not found

1 Answers