Cannot connect to Home Assistant via HTTPS without a full certificate chain

[timoschwarzer]

Home Assistant Android app version(s): 2026.6.5-full

Android version(s): 16

Device model(s): Pixel 9a

Home Assistant version: 2026.8.2

Last working Home Assistant release (if known): -

Description of problem, include YAML if issue is related to notifications:

My setup is as following:

• Home Assistant OS runs with HTTP on port 8123
• There is a reverse proxy (Traefik) that terminates TLS and forwards requests to Home Assistant
• I am running a PKI with a custom root certificate
• The root certificate is installed as user certificate on the Android device. Traefik serves HTTPS with a leaf certificate that is signed with an intermediate CA certificate, which in turn is signed with the root certificate.
• I cannot make Traefik serve the full certificate chain due to technical limitations¹. But this shouldn't be required (anymore) if I read the issues linked below correctly.

Opening the HA interface in a web browser works perfectly fine, even logging in inside the app works until I press the confirmation button on the page where it asks me for the device name (see screenshot). Then the error message pops up and it cancels the login process.

Companion App Logs:

ADB Logs

08-18 16:06:44.820  7454  7454 E NameYourDeviceViewModel$onSaveClick: Error while adding server
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:358)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1131)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1086)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:873)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:744)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:709)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:912)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.-$$Nest$mprocessDataFromSocket(Unknown Source:0)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:242)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:224)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.connection.ConnectPlan.connectTls(ConnectPlan.kt:352)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.connection.ConnectPlan.connectTlsEtc(ConnectPlan.kt:206)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.connection.FastFallbackExchangeFinder.find(FastFallbackExchangeFinder.kt:78)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:304)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:332)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:98)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:332)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:332)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:72)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:332)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:232)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at okhttp3.internal.connection.RealCall$AsyncCall.run(RealCall.kt:580)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1154)
08-18 16:06:44.821  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:652)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at java.lang.Thread.run(Thread.java:1563)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 27 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 24 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 40 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 27 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 24 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 40 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 27 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 24 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.822  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 27 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 24 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 27 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 24 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 			... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:693)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:526)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:446)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:374)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:96)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:94)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at io.homeassistant.companion.android.controls.HaControl$$ExternalSyntheticApiModelOutline0.m$1(D8$$SyntheticClass:0)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at io.homeassistant.companion.android.common.data.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.kt:59)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:169)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:283)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1635)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	... 24 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Suppressed: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 		... 40 more
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
08-18 16:06:44.823  7454  7454 E NameYourDeviceViewModel$onSaveClick: 	... 40 more

Screenshot or video of problem:

Additional information:

Related issues/PRs:

• Use default Trust manager and fallback to user installed CA #7044
• ssl handshake failed #6810

Footnotes

1. Traefik is running inside a Kubernetes Cluster, together with cert-manager. Cert-manager is currently hardcoded to not include the full certificate chain when using custom root certificates. ↩

[jpelgrom]

Your suggestion that this should now work seems correct based on the log snippet you've provided. Just to be sure: the custom certificate is installed on your device, and there is no additional authentication mechanism in place?

[timoschwarzer]

@jpelgrom correct! In browsers and even in the web view that is used to login inside the app everything works. Only when the app tries to directly communicate with the HA server, it fails to validate the certificate.

There's no mTLS, no special login mechanism (no basic auth, no oidc), just plain HA login with username and password and no further TLS authentication. I only installed the root certificate in the Android settings.