home-assistant / home-assistant/android
Cannot connect to Home Assistant via HTTPS without a full certificate chain
Open
bug
- Dominant language
- Kotlin
- Stars
- 3.9k
- Forks
- 1.1k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 81
Description
**Home Assistant Android app version(s):** 2026.6.5-full
**Android version(s):** 16
**Device model(s):** Pixel 9a
**Home Assistant version:** 2026.8.2
**Last working Home Assistant release (if known):** -
**Description of problem, include YAML if issue is related to notifications:**
My setup is as following:
- Home Assistant OS runs with HTTP on port 8123
- There is a reverse proxy (Traefik) that terminates TLS and forwards requests to Home Assistant
- I am running a PKI with a custom root certificate
- The root certificate is installed as user certificate on the Android device. Traefik serves HTTPS with a leaf certificate that is signed with an intermediate CA certificate, which in turn is signed with the root certificate.
- I cannot make Traefik serve the full certificate chain due to technical limitations[^1]. But this shouldn't be required (anymore) if I read the issues linked below correctly.
Opening the HA interface in a web browser works perfectly fine, even logging in inside the app works until I press the confirmation button on the page where it asks me for the device name (see screenshot). Then the error message pops up and it cancels the login process.
**Companion App Logs:**
ADB Logs
08-18 16:06:44.820 7454 7454 E NameYourDeviceViewModel$onSaveClick: Error while adding server
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:358)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1131)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1086)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:873)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:744)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:709)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:912)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.-$$Nest$mprocessDataFromSocket(Unknown Source:0)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:242)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:224)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.connection.ConnectPlan.connectTls(ConnectPlan.kt:352)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.connection.ConnectPlan.connectTlsEtc(ConnectPlan.kt:206)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.connection.FastFallbackExchangeFinder.find(FastFallbackExchangeFinder.kt:78)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:304)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:332)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:98)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:332)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:332)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:72)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:332)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:232)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at okhttp3.internal.connection.RealCall$AsyncCall.run(RealCall.kt:580)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1154)
08-18 16:06:44.821 7454 7454 E NameYourDeviceViewModel$onSaveClick: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:652)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at java.lang.Thread.run(Thread.java:1563)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 27 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 24 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 27 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 24 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 27 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 24 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 27 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 24 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 27 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 24 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 24 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823 7454 7454 E NameYourDeviceViewModel$onSaveClick: ... 40 more
**Screenshot or video of problem:**
**Additional information:**
Related issues/PRs:
- https://github.com/home-assistant/android/pull/7044
- https://github.com/home-assistant/android/issues/6810
[^1]: Traefik is running inside a Kubernetes Cluster, together with cert-manager. Cert-manager is currently hardcoded to not include the full certificate chain when using custom root certificates.
Contributor guide
Research direction
Start with the add-server flow shown by NameYourDeviceViewModel$onSaveClick and inspect CompositeX509ExtendedTrustManager.kt around line 59. Reproduce the HTTPS login against a server that omits the intermediate certificate, then trace the trust failure. Done means the app can complete setup with the described custom-root certificate configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100