Explain certificate trust failures with actionable guidance#39
Open
lostf1sh wants to merge 1 commit into
Open
Conversation
Self-signed certificate handshake failures during Jellyfin/Navidrome
login surfaced raw Java exception text ("Trust anchor for certification
path not found"). Map SSL trust and hostname-verification failures to a
message that tells the user to install their CA certificate in Android
settings, which the app honors via its network security config.
Complements 3cbb75b (user-installed CA trust, unreleased as of v0.1.0).
Fixes #34
lostf1sh
force-pushed
the
fix/issue-34-user-ca-error-hint
branch
from
bac0d0e to
173bf50
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Analysis of #34
The reporter installed their self-signed CA in the Android user certificate store, but the app rejected the connection. Root cause is release lag: user-installed CA trust was added to
network_security_config.xmlin 3cbb75b (June 18), but the latest release v0.1.0 (June 9) predates it — so the released build only trusts system CAs. On currentmain, the scenario in the issue already works: all HTTP traffic goes through OkHttp/HttpURLConnection, both of which honor the network security config, and no code path installs a custom TrustManager. The fix ships with the next release.What this PR adds
Even with user-CA trust in place, a user who hasn't (or incorrectly) imported their CA hits a raw Java exception in the login screen (
Trust anchor for certification path not found), with no hint that the app does support user-installed CAs. This PR maps TLS trust failures in the Jellyfin and Navidrome login flows to actionable messages:Detection walks the exception cause chain, since OkHttp wraps
CertPathValidatorExceptioninsideSSLHandshakeException(sometimes further wrapped inIOException).Testing
ConnectionErrorsTest(handshake failure, nested cause chain, bareCertificateException, hostname mismatch, unrelated-error passthrough) — all pass via:app:testDebugUnitTestFixes #34