Expo React Native安卓模拟器请求后端出现TLS握手错误

本地开发的React Native Expo应用运行在Pixel 8安卓模拟器上，向后端发送HTTP请求时触发「TypeError: Network request failed」错误。查看Docker Compose运行的Traefik代理日志，发现错误信息：
http: TLS handshake error from 172.22.0.1:40280: remote error: tls: unknown certificate

已尝试的排查操作 #

• 反复确认API请求的主机地址正确（10.0.2.2）
• Traefik代理使用自签名证书，且CA pem文件已添加至安卓设置的可信证书列表中

相关配置文件 #

app.json #

{
  "expo": {
    "jsEngine": "hermes",
    "name": "myapp",
    "slug": "mobileapp",
    "version": "1.0.0",
    "orientation": "portrait",
    "icon": "./assets/icon.png",
    "splash": {
      "image": "./assets/splash.png",
      "resizeMode": "contain"
    },
    "updates": {
      "fallbackToCacheTimeout": 0
    },
    "assetBundlePatterns": [
      "**/*"
    ],
    "ios": {
      "jsEngine": "hermes",
      "supportsTablet": true,
      "bundleIdentifier": "com.myapp.mobileapp"
    },
    "userInterfaceStyle": "automatic",
    "android": {
      "jsEngine": "hermes",
      "adaptiveIcon": {
        "foregroundImage": "./assets/adaptive-icon.png",
        "backgroundColor": "#4149b0"
      },
      "softwareKeyboardLayoutMode": "pan",
      "package": "com.myapp.mobileapp"
    },
    "web": {
      "favicon": "./assets/favicon.png",
      "bundler": "metro"
    },
    "plugins": [
      [
        "expo-font",
        {
          "fonts": [
            "./assets/fonts/SourceSans3Bold.ttf",
            "./assets/fonts/SourceSans3SemiBold.ttf",
            "./assets/fonts/SourceSans3Medium.ttf",
            "./assets/fonts/SourceSans3Regular.ttf"
          ]
        }
      ],
      [
        "expo-secure-store",
        {
          "faceIDPermission": "Allow $(PRODUCT_NAME) to access your Face ID biometric data.",
          "touchIDPermission": "Allow $(PRODUCT_NAME) to access your Touch ID biometric data."
        }
      ],
      [
        "./withAndroidPlaid.js"
      ]
    ]
  }
}

docker-compose.yml（Traefik代理部分） #

...
  proxy:
    image: traefik:v2.10
    command:
      - "--api.insecure=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entryPoints.websecure.forwardedHeaders.insecure"
      # ^^ needed so that we can check ip address of the ory webhook response in the django middleware
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.file.directory=/traefik"
      - "--providers.file.watch=true"
      - "--log.level=DEBUG"
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - ./front/certs:/etc/ssl/certs
      - ./traefik:/traefik
      - /var/run/docker.sock:/var/run/docker.sock
...

traefik.config #

tls:
  certificates:
    - certFile: /etc/ssl/certs/localhost.crt
      keyFile: /etc/ssl/certs/localhost.key

内容的提问来源于stack exchange，提问作者Spencer