Webview: Failed to validate the certificate chain

user_1063706 0
Viewed 14385

I'm trying to open my website https://beta.truckerdistrict.com in a react native app and it's giving me a white screen without any error or alerts in UI. I tested https://facebook.com and other and all is working fine. Checking logs I found the following error:

Failed to validate the certificate chain, error: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found

Here is my webview code, it's really simple without anything special:

 <WebView
        ref={this.WEBVIEW_REF}
        userAgent={this.USER_AGENT}
        javaScriptEnabled={true}
        uploadEnabledAndroid={true}
        allowUniversalAccessFromFileURLs={true}
        mixedContentMode="always"
        onNavigationStateChange={this._onNavigationStateChange}
        onLoadEnd={this._onLoadEnd}
        onError={this._onLoadError}
        onMessage={this._onWebMessage}
        source={{uri: this.BASE_URL}}
react-native android
4 Answers

If you're using an Android 7.0/6/5/4 device (API 24 or below), and your website uses 'Let's Encrypt' SSL certificates to gain HTTPS support for URLs, these devices will no longer trust the Let's Encrypt certificates, starting from 1 September 2021. You will start seeing errors like this in WebViews that load HTTPS pages:

I/X509Util: Failed to validate the certificate chain, error: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

or

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

If you use onReceivedSslError() in your WebView, it will trigger the case of SslError.SSL_UNTRUSTED

Android 7.1 (API 25) and above is not affected.

Possible workarounds are to fallback to HTTP on these old devices, or change the certificate service on your web backend service. Another potential workaround is to use Firefox web browser on the old devices, because Firefox does trust Let's Encrypt.

Sources:

user_65120570

Sometimes its because your root ca certificate is not chained as part of the server certificate.

Simply add the ca.crt right after the server.crt (in the same file)

Webview is sensitive for that, yet chrome desktop is not...

user_21879130

adding property to override the issue in manifest file, Application tag working for me. <application

android:usesCleartextTraffic=”true”>

user_129789580
Related