Take the 2-minute tour ×

The data source for my application had their SSL certificate expire and they now have a new SSL certificate. This is causing an an javax.net.ssl.SSLException: Not trusted server certificate error in the debugger when I try to execute an https:// POST.

How do I fix this error in my application? Do I need to redeploy to all devices?

share|improve this question
the error I am getting from the Android debugger is "javax.net.ssl.SSLException: Not trusted server certificate." –  emdog4 Sep 28 '11 at 16:00

4 Answers 4

up vote 0 down vote accepted

The resolution can now be found online. I have yet to find a working solution, but basically you will need to get the certificate, create a keystore with the credentials, and use it in your android application. Once I have more information I will update the post here.

share|improve this answer

Assuming the new certificate is valid and trustworthy you shouldn't need to change your application. (Unless you were specifically expecting the certificate or doing something unusual with respect to SSL in your application.)

Here's a pretty handy tool for validating an SSL certificate of an internet host: http://www.digicert.com/help/

Or, just use the https URL that your app is using in your desktop browser to inspect the certificate (assuming its bad, most browsers do a good job of explaining the problem and providing the certificate's details). If your app is using an IP address or a specific domain name, try with that exact domain name. (The rest of the URL doesn't matter, just the https://host.example.com/ part.)

Perhaps the old certificate was more permissive (perhaps it included a broader set of hosts within the domain?)

On the other hand, if the problem is that the new certificate contains a wildcard (i.e., its for "*.example.com", then the SSL bug that nmr points out (See http://code.google.com/p/android/issues/detail?id=17680) could be the culprit. Fixing this involves upgrading the version of Android. Or hacking your application sufficiently to accept this known certificate. Or, asking the server manager to install a better SSL certificate for you (assuming you have any sway over your "data source").

share|improve this answer
please see my comment in the original post –  emdog4 Sep 28 '11 at 16:01
Yeah, the error you're getting says that Android does not trust the SSL certificate it got from the server. So, I'm suggesting that you look into what the SSL certificate on the server says now to see if we can diagnose the problem. (Specifically, does everyone think its a bad cert, or just Android?) –  P.T. Sep 28 '11 at 16:22
I'm not sure what the original certificate was. Does that make a difference? –  emdog4 Sep 28 '11 at 16:27
It would be handy to know what the original cert is, but it is not required. –  P.T. Sep 28 '11 at 16:36
how can I get the original certificate? and the new one? –  emdog4 Oct 4 '11 at 13:01

There's a bonanza of SSL bugs in Android that could be causing this problem, assuming the cert's valid.

Are you using URLConnection or HttpClient?

On what version of Android is it failing?

Two bugs I have run into:

Add the URL that you're trying to connect to and people might be able to look at that.

share|improve this answer
it's failing on all versions of android, afiak. please see my comment in the original post –  emdog4 Sep 28 '11 at 16:01

First of all you should take a look at the new certificate. What had been changed exactly? e.g.

  • Is the new certificate using the same common name (CN)?
  • Does the CN match the hostname you're querying?
  • Is it signed by a different certificate authority (CA)?
  • If so, is this CA trusted by Android?

As you have lost your private application signing key, then you're basically stuck. (Everybody reading this: Always backup your keystore and store it in at least one secure place. Otherwise there is no way back.)

Is the DataSource you are using by a third party? If you are able to change the certificate to one that Android trusts, your app could be revived. I don't see another solution here.

But anyway, where are you going with your app?

With a free app, it is not too bad. Change the package name in your code and make a new app. Publish it. Use a hint in the text at your old app to advise people that this one is not being updated anymore and they should get your new app.

If it is a paid app you will face hard times finding a way to migrate your present users.

Sorry to say it, because this is a painful situation, but this must be a software engineering lesson you skipped. Your signatures are the most important thing to backup. You can always re-engineer your code, while you do not have any chance with your keys.

As the mentioned facts are common sense, the only "official source" I can provide is this text about the importance of securing your private key.

share|improve this answer

Your Answer


