更换服务器可信证书后Android HTTPS请求失败求助

Hey there! Let's tackle this HTTPS certificate error you're running into. Even though your certificate is issued by a trusted CA, Android's default trust store might not recognize it—here's why and how to fix it:

Common Causes & Solutions #

1. Incomplete Certificate Chain on the Server #

Most of the time, this error happens because the server isn't sending the full certificate chain (leaf certificate + intermediate CA certificates). Browsers often fill in missing intermediates automatically, but Android's network stack doesn't.

How to check:

• Open your target URL in Chrome, click the lock icon → "Certificate" → "Details" tab.
• Check the "Certificate Hierarchy"—you should see your domain's certificate, one or more intermediate CAs, and the root CA at the top.
• If any intermediate is missing, that's the problem.

Fix:

• Ask your server admin to deploy the full certificate chain: concatenate your domain's certificate file with all intermediate CA certificates (in order, leaf first, intermediates next) into a single file, then update the server config (Apache, Nginx, etc.) to use this combined file.

2. CA Certificate Not Preinstalled on Older Android Versions #

Newer CAs (like Let's Encrypt's ISRG Root X1) aren't included in Android versions before 7.0. If your app supports older devices, you'll need to bundle the CA certificate with your app.

Step-by-step fix:

a. Export the CA Certificate

• From Chrome's certificate details (as above), go to the root or intermediate CA that's missing in Android's trust store.
• Click "Copy to File" → choose "Base-64 encoded X.509 (.CER)" → save it as my_ca.cer.

b. Add the Certificate to Your App

• Place the my_ca.cer file into your app's res/raw directory (create the folder if it doesn't exist).

c. Modify Your Code to Use the Custom Trust Store

Replace your existing doInBackground code with this updated version that loads the custom certificate:

protected String doInBackground(String... urls) {
    URL url = null;
    StringBuffer buffer = null;
    try {
        url = new URL("https://your-domain.com/test");
        
        // Load the custom CA certificate
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        InputStream certInputStream = getApplicationContext().getResources().openRawResource(R.raw.my_ca);
        Certificate ca;
        try {
            ca = cf.generateCertificate(certInputStream);
        } finally {
            certInputStream.close();
        }

        // Create a KeyStore containing our trusted CA
        String keyStoreType = KeyStore.getDefaultType();
        KeyStore keyStore = KeyStore.getInstance(keyStoreType);
        keyStore.load(null, null);
        keyStore.setCertificateEntry("ca", ca);

        // Create a TrustManager that trusts the CA in our KeyStore
        String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
        tmf.init(keyStore);

        // Create an SSLContext that uses our TrustManager
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, tmf.getTrustManagers(), null);

        // Set up the HttpURLConnection with our custom SSL context
        HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();
        urlConnection.setSSLSocketFactory(sslContext.getSocketFactory());
        urlConnection.setRequestMethod("GET");
        urlConnection.connect();

        // Read the input stream into a String
        InputStream inputStream = urlConnection.getInputStream();
        buffer = new StringBuffer();
        if (inputStream == null) {
            return null;
        }
        BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
        String line;
        while ((line = reader.readLine()) != null) {
            buffer.append(line + "\n");
        }

    } catch (IOException | CertificateException | NoSuchAlgorithmException | KeyStoreException | KeyManagementException e) {
        e.printStackTrace();
    }
    if (buffer == null || buffer.length() == 0) {
        return null;
    }
    return buffer.toString();
}

Notes:

• Make sure to replace R.raw.my_ca with the actual name of your certificate file (without the .cer extension).
• This code adds your CA to the app's trusted list while still respecting system-trusted CAs (unlike disabling certificate validation entirely, which is unsafe).

Why Your Original Code Failed #

The default HttpURLConnection uses Android's system trust store. If the CA that issued your certificate isn't preinstalled in that store (either because the chain is incomplete or the CA is new), the validation fails with the "Trust anchor not found" error.

内容的提问来源于stack exchange，提问作者Ramon