CertPathValidatorException: Trust anchor for certification path not found

Question

I added HTTPPinning to OKHTTPClient the sample code is:

OkHttpClient client = new OkHttpClient();
client.setSslSocketFactory(getPinnedCertSslSocketFactory(context));


private SSLSocketFactory getPinnedCertSslSocketFactory(Context context) {
    try {
        KeyStore trusted = KeyStore.getInstance("BKS");
        InputStream incontext.getResources().openRawResource(R.raw.prod_keystore);
        trusted.load(in, "venkat@123".toCharArray());
        SSLContext sslContext = SSLContext.getInstance("TLS");
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(
                TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trusted);
        sslContext.init(null, trustManagerFactory.getTrustManagers(), null);
        return sslContext.getSocketFactory();
    } catch (Exception e) {
        Log.e("MyApp", e.getMessage(), e);
    }
    return null;
}

I uploaded the app into playstore and from the last 1 year on wards it is working good. but from the last 1 week onwards it is giving the below issue and I used OkHttp of version com.squareup.okhttp:okhttp:2.7.4

java.security.cert.CertPathValidatorException: Trust anchor for 
          certification path not found.
javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
                  at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
                  at com.squareup.okhttp.internal.io.RealConnection.connectTls(RealConnection.java:192)
                  at com.squareup.okhttp.internal.io.RealConnection.connectSocket(RealConnection.java:149)
                  at com.squareup.okhttp.internal.io.RealConnection.connect(RealConnection.java:112)
                  at com.squareup.okhttp.internal.http.StreamAllocation.findConnection(StreamAllocation.java:184)
                  at com.squareup.okhttp.internal.http.StreamAllocation.findHealthyConnection(StreamAllocation.java:126)
                  at com.squareup.okhttp.internal.http.StreamAllocation.newStream(StreamAllocation.java:95)
                  at com.squareup.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:281)
                  at com.squareup.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:224)
                  at com.squareup.okhttp.Call.getResponse(Call.java:286)
                  at com.squareup.okhttp.Call$ApplicationInterceptorChain.proceed(Call.java:243)
                  at com.squareup.okhttp.Call.getResponseWithInterceptorChain(Call.java:205)
                  at com.squareup.okhttp.Call.execute(Call.java:80)
                  at com.venkat.good.http.MyHTTPThread.run(MyHTTPThread.java:492)
                  at com.venkat.good.http.MyHTTPThread.run(MyHTTPThread.java:76)
                  at java.lang.Thread.run(Thread.java:818)

by using OKHTTP3 i resolved this issue.

String hostname = "yourdomain.com";
  CertificatePinner certificatePinner = new CertificatePinner.Builder()
 .add(hostname, "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
 .build();
   OkHttpClient client = OkHttpClient.Builder()
 .certificatePinner(certificatePinner)
 .build();

  Request request = new Request.Builder()
 .url("https://" + hostname)
 .build();
 client.newCall(request).execute();

But I want to know why the previous OkHttp2 version works for some days and after that it raises the issue?

Is there a chance that something changed on the server side or that the certificate expired? — Doron Yakovlev-Golani
I didn't specify any date while creating the BKS file and the server people didn't change anything at their side. — Venkat

DEX7RA DEX7RA · Accepted Answer · 2021-07-11T17:28:41

Better late than never

Glad you managed your problem with OkHttp3.

Let me just answer your asked sub question:

This was a build system configuration problem, not a problem with OkHttp. Everyone was surprised to see to behave that way because it should be resolving the higher version required by OkHttp3 for use. If you were using maven or retrofit a fix has been merged into the newer version (OkHttp3 implemented it for the mentioned libraries).

CertPathValidatorException: Trust anchor for certification path not found

1 Answers