rustls-platform-verifier certificate verification fails on Android (26.07.x–26.07.28), likely rustls-platform-verifier#221 — reproducible with minimal ClientBuilder setup

Nobody has claimed this yet.

Environment

Library: org.matrix.rustcomponents:sdk-android
Versions tested: 26.06.11 (works), 26.07.15, 26.07.23, 26.07.28 (all fail identically)
Device: Fairphone FP4, real hardware (not emulator)
Homeserver: matrix.org

Minimal repro — Application setup

```kotlin
class App : Application() {
override fun onCreate() {
super.onCreate()
initPlatform(
config = TracingConfiguration(
logLevel = LogLevel.WARN,
traceLogPacks = emptyList(),
extraTargets = emptyList(),
writeToStdoutOrSystem = true,
writeToFiles = null,
sentryConfig = null,
),
useLightweightTokioRuntime = false,
)
}
}
```

Registered correctly via android:name=".App" in the manifest — confirmed via logs that initPlatform() returns without throwing.

Minimal repro — client construction

```kotlin
private suspend fun buildClient(sessionPath: String): Client {
val c = ClientBuilder()
.sessionPaths(dataPath = "$sessionPath/data", cachePath = "$sessionPath/cache")
.serverNameOrHomeserverUrl("matrix.org")
.slidingSyncVersionBuilder(SlidingSyncVersionBuilder.NATIVE)
.build() // ← fails here on 26.07.x+
client = c
return c
}
```
.build() throws / the first subsequent network call (well-known discovery or login) fails with:

Expect rustls-platform-verifier to be initialized

On some code paths instead:

error sending request for url (https://matrix.org/.well-known/matrix/client)

Diagnostic test that isolates the cause to certificate verification

Adding .disableSslVerification() makes the exact same code succeed immediately:

```kotlin
val c = ClientBuilder()
.sessionPaths(dataPath = "$sessionPath/data", cachePath = "$sessionPath/cache")
.serverNameOrHomeserverUrl("matrix.org")
.slidingSyncVersionBuilder(SlidingSyncVersionBuilder.NATIVE)
.disableSslVerification() // diagnostic only — makes it work
.build()
```

This rules out networking, DNS, TLS handshake timing, and initPlatform() ordering as causes — the failure is specifically in the certificate verification path.

What I've already ruled out

Device network/TLS stack is fine: Chrome on the same device loads https://matrix.org/.well-known/matrix/client without issue.
System clock is correct and set to automatic.
Added android:usesCleartextTraffic="true" (to allow CRL fetches over HTTP as suggested in #6319) — no change in behavior.
Confirmed initPlatform() completes successfully before any ClientBuilder call (verified via writeToStdoutOrSystem logs).
Reverting to 26.06.11 (pre reqwest-0.13 bump) resolves the issue with zero app-code changes — strongly pointing to the TLS backend change as the regression point.

Suspected root cause

This matches the chain described in #6319 → rustls/rustls-platform-verifier#221: Android's verifier returns Revoked for certificates that only have a CRL Distribution Point and no OCSP URL (the case for all Let's Encrypt certs issued after Aug 2025 OCSP sunset). matrix.org's certificate is presumably Let's Encrypt-issued. #6319 is closed here, but #221 is still open upstream as of writing.

Questions

Is there a supported way on the Kotlin bindings side to use webpki instead of rustls-platform-verifier for certificate verification, without going through disableSslVerification()?
Is there a way to disable revocation checking (CRL/OCSP) specifically while keeping full chain/hostname verification? That would be a much safer workaround than disabling verification entirely.
Is 26.06.11 still the recommended last-known-good version for Android, or is there a fix already landed that I'm missing (I also tried 26.09.08, where RoomListService.subscribeToRooms was renamed to setRoomSubscriptions/resetAndAddRoomSubscriptions — happy to test that version's TLS behavior too if useful for triage).

I can provide full logcat output (with logLevel = DEBUG), a minimal standalone repro project, or test any suggested config. Would really like to avoid shipping disableSslVerification() even in debug builds long-term.

Start with the minimal Kotlin ClientBuilder setup and initPlatform() sequence in the report, comparing 26.06.11 with the failing 26.07.x versions. Reproduce against matrix.org without disableSslVerification(), then investigate the certificate-verification path described in #6319 and rustls-platform-verifier#221. Done means identifying a supported safe configuration or regression fix that preserves chain and hostname verification.

Written by the indexing model from the issue text.