easysync icon indicating copy to clipboard operation
easysync copied to clipboard

Error: CertPathValidationExeption. Trust anchor for cert path not found [and suggest a definite requirement]

Open WillemsenGithub opened this issue 1 year ago • 6 comments

Error: When entering credentials Error: CertPathValidationExeption. Trrust anchor for cert path not found

LineageOS 19 NC 28 Server, works like a charm

Guess issue is caused by a Custom Certificate. Maybe. The Readme here describes how to enter that in Android, but cant find it in LineageOS.

Some Android apps simply ask you to accept a Custom cert, would be nice default functionality.

WillemsenGithub avatar Feb 21 '24 16:02 WillemsenGithub

Just hang in there, maybe found a workaround

WillemsenGithub avatar Feb 21 '24 16:02 WillemsenGithub

Imported the Custom cert in LineageOS, searching "Encryption" showed the proper options to install certs. Now the error is that the Hostname is not verified. Thats bc I changed the IP-port to access the server from default.

No other app ever got any hangups because of that. A simple: "Yes I know, I accept, just get on with it" would be a definite requirement.

Can you add this instead of blocking functionality completely ?

WillemsenGithub avatar Feb 21 '24 16:02 WillemsenGithub

Your certificate common name should match the name you use to reach your server. Disabling a security measures defeats the purpose of TLS.

  • If your server is public, just use your DNS record on your phone and have it in the CN of your certificate.
  • Otherwise,
    • if you use an IP address, add it to your CN (or alt name),
    • if you use a local hostname resolution on your local network, add it to your CN (or alt name)

phpbg avatar Feb 22 '24 14:02 phpbg

The CN name matches the DNS name, of course. Only the port is different

All other Android apps (NC, Davx, TotCmd DavX, Browsers etc) have no issue with this, may ask confirmation, then I accept. Its likely on the apps size of things.

WillemsenGithub avatar Feb 23 '24 13:02 WillemsenGithub

AFAIK the port is usually not checked when making TLS connection.

Does your CN include a port?

phpbg avatar Feb 23 '24 13:02 phpbg

No it does not, it says "host.domain.ext" [specific details left out] exactly as it is registered in Dynamic DNS Additionally tried FolderSynch, also just asks for confirmation and does what it should (adds however, so skip) Am I missing sth here ?

WillemsenGithub avatar Feb 25 '24 13:02 WillemsenGithub

See #39

phpbg avatar Oct 19 '24 08:10 phpbg