android - 让我们在 Android 上加密给出 java.security.cert.CertPathValidatorException : Trust anchor for certification path not found

Question

您好，您已经设置了一个小型服务，从 Let's encrypt 生成了一个免费证书，并将 Nginx 配置为使用该证书(fullchain.pem 和 privkey.pem)

但是，当我尝试从我的 Android 应用程序(使用 OkHttp3)调用电话时我得到这个错误

java.security.cert.CertPathValidatorException: Trust anchor for certification path not found

Android 证书信任库是否不信任 Let's encrypt 根证书？还是我在设置 nginx 时遗漏了什么？如果我仍然想使用 Let's encrypt certificates，有什么解决方法？

Answer 1

我不确定它是否有用，但是 /etc/letsencrypt/live/<your domain>/README文件说:

This directory contains your keys and certificates.

privkey.pem : the private key for your certificate.

fullchain.pem: the certificate file used in most server software.

chain.pem : used for OCSP stapling in Nginx >=1.3.7.

cert.pem : will break many server configurations, and should not be used without reading further documentation (see link below).

We recommend not moving these files. For more information, see the Certbot User Guide at https://certbot.eff.org/docs/using.html#where-are-my-certificates.

所以也许你应该使用 chain.pem ？

另一方面，对于那些甚至不使用 Nginx 的人，我从 Android 收到了同样的错误，因为我错误地使用了 chain.pem而不是 fullchain.pem .Android 应用程序的解决方案之一要求您发送整个证书链(即:fullchain.pem)，如此处所述:

https://developer.android.com/training/articles/security-ssl.html#CommonHostnameProbs

There are two approaches to solve this issue:

• Configure the server to include the intermediate CA in the server chain. Most CAs provide documentation on how to do this for all common web servers. This is the only approach if you need the site to work with default Android browsers at least through Android 4.2.

• Or, treat the intermediate CA like any other unknown CA, and create a TrustManager to trust it directly, as done in the previous two sections.

希望对您有所帮助。