SSLHandshakeException Trust anchor for certification path not found Android HTTPS

I’m trying to establish a connection to a HTTPS site and I got this exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
My original code is as follows:

URL url = new URL("https://example.com");
            HttpsURLConnection urlConnection =
                (HttpsURLConnection)url.openConnection();
            in = urlConnection.getInputStream();
            byte[] responsedata = CommonUtil.readInputStream(in);
            Log.w(TAG, "response is "+CommonUtil.convertBytesToHexString(responsedata));

JavaScript
​x
 
URL url = new URL("https://example.com");            HttpsURLConnection urlConnection =                (HttpsURLConnection)url.openConnection();            in = urlConnection.getInputStream();            byte[] responsedata = CommonUtil.readInputStream(in);            Log.w(TAG, "response is "+CommonUtil.convertBytesToHexString(responsedata));​

Then, I read Google’s article here and modified my code to:

CertificateFactory cf;
        try {
            cf = CertificateFactory.getInstance("X.509");
            InputStream in = this.mContext.getResources().openRawResource(R.raw.cert);
            Certificate ca;
            ca = cf.generateCertificate(in);
                System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
                in.close();
                URL url = new URL("https://example.com");
                HttpsURLConnection urlConnection =
                (HttpsURLConnection)url.openConnection();
                in = urlConnection.getInputStream();
                byte[] responsedata = CommonUtil.readInputStream(in);
            Log.w(TAG, "response is "+CommonUtil.convertBytesToHexString(responsedata));
            in.close();

JavaScript
 
CertificateFactory cf;        try {            cf = CertificateFactory.getInstance("X.509");            InputStream in = this.mContext.getResources().openRawResource(R.raw.cert);            Certificate ca;            ca = cf.generateCertificate(in);                System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());                in.close();                URL url = new URL("https://example.com");                HttpsURLConnection urlConnection =                (HttpsURLConnection)url.openConnection();                in = urlConnection.getInputStream();                byte[] responsedata = CommonUtil.readInputStream(in);            Log.w(TAG, "response is "+CommonUtil.convertBytesToHexString(responsedata));            in.close();  ​

Regarding the R.raw.cert file, I use this site to check the certificates of the site. I found 3 cetificates and I have no idea which one to use. I tried them one by one.
The one name “VeriSign Class 3 Public Primary Certification Authority – G5” results in the following exceptions:

01-17 17:46:54.759: E/Process(8764): java.security.cert.CertificateException: org.apache.harmony.xnet.provider.jsse.OpenSSLX509CertificateFactory$ParsingException: org.apache.harmony.xnet.provider.jsse.OpenSSLX509CertificateFactory$ParsingException: java.lang.RuntimeException: error:0906D06C:PEM routines:PEM_read_bio:no start line

JavaScript
 
01-17 17:46:54.759: E/Process(8764): java.security.cert.CertificateException: org.apache.harmony.xnet.provider.jsse.OpenSSLX509CertificateFactory$ParsingException: org.apache.harmony.xnet.provider.jsse.OpenSSLX509CertificateFactory$ParsingException: java.lang.RuntimeException: error:0906D06C:PEM routines:PEM_read_bio:no start line  ​

When I use the one named “VeriSign Class 3 Secure Server CA – G3” or the one with the name “example.com” (same as the site name) I got the same SSLHandshakeException.

What do I need to do?

At the same time, Symatec SSL Toolbox shows me an error and 1 recommendation which I don’t understand:

Intermediate certificate missing.
VeriSign Class 3 Secure Server CA - G3

Update your certificate chain.
Your certificate chain is valid, but some older browsers may not recognize it. To support older browsers, download and install the missing intermediate certificate

JavaScript
 
Intermediate certificate missing.VeriSign Class 3 Secure Server CA - G3​Update your certificate chain.Your certificate chain is valid, but some older browsers may not recognize it. To support older browsers, download and install the missing intermediate certificate  ​

The 3 certificates found for the site are as follows:
example.com:

JavaScript
 
-----BEGIN CERTIFICATE-----MIIGaDCCBVCgAwIBAgIQCG32zRgBgFoe6wciBqTuGjANBgkqhkiG9w0BAQUFADCBtTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEvMC0GA1UEAxMmVmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzMwHhcNMTQwMTA4MDAwMDAwWhcNMTYxMjIyMjM1OTU5WjCCASYxCzAJBgNVBAYTAkJSMQswCQYDVQQIEwJTUDEQMA4GA1UEBxQHVGF1YmF0ZTEcMBoGA1UEChQTTW9ycGhvIGRvIEJyYXNpbCBTQTEMMAoGA1UECxQDVEJFMTgwNgYDVQQLEy9UZXJtcyBvZiB1c2UgYXQgd3d3LmNlcnRpc2lnbi5jb20uYnIvcnBhIChjKSAwNDE+MDwGA1UECxM1QXV0aGVudGljYXRlZCBieSBDZXJ0aXNpZ24gQ2VydGlmaWNhZG9yYSBEaWdpdGFsIExUREExJzAlBgNVBAsTHk1lbWJlciwgU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEpMCcGA1UEAxQgbmZjZGVtby5tb3JwaG9jYXJkc2JyYXNpbC5jb20uYnIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKx+bgoEz+fc3wKAmi+hTR39GS70qE3Zl68VVqQnfdVH1qRp1GRFBls9vZ1IUJ0/bVRpU/FFzB8gAO8Z7DrJbLRMcOuqGUyhoNPcz35KiwL7ebT6E99H/hzm9Xfzy44GeRWJo+vyKQZ38Iz+4qfc+nWzQ913szF2+Q7kV4/Iyq7syDs0gY8CYHPmsV+zbT2XgJUtZwc7cIspCxzzADQV63wg242W9N9akvp1BY8s7dmKvOOIThT72pDdeKbTKrAyHUitKIAmMoAjF2bHs1jzVdxX3KdTnb0Z9CHxAHBlgwfPA2K/02vTOJuvyApItkhCzlqekMPYbEHQshFLPVVQCFAgMBAAGjggH+MIIB+jArBgNVHREEJDAigiBuZmNkZW1vLm1vcnBob2NhcmRzYnJhc2lsLmNvbS5icjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIFoDBFBgNVHR8EPjA8MDqgOKA2hjRodHRwOi8vU1ZSU2VjdXJlLUczLWNybC52ZXJpc2lnbi5jb20vU1ZSU2VjdXJlRzMuY3JsMEQGA1UdIAQ9MDswOQYLYIZIAYb4RQEHFwMwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYTAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUDURcFlNEwYJ+HSCrJfQBY9i+eaUwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9TVlJTZWN1cmUtRzMtYWlhLnZlcmlzaWduLmNvbS9TVlJTZWN1cmVHMy5jZXIwbgYIKwYBBQUHAQwEYjBgoV6gXDBaMFgwVhYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUS2u5KJYGDLvQUjibKaxLB4shBRgwJhYkaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nbzEuZ2lmMA0GCSqGSIb3DQEBBQUAA4IBAQCXgvX168gMhEvTtuSQIoqxM0XozddBkRKwTo/t151AvimsJ0WnCVcN8IQt8SVrqitqV2NlqH+nx8EpQbTyFSbeYLZ9CPiQkPPayO3CjYMVSOPoyxchbe2GhvvFZDEU8Ec5Mv0YmLXkTJdRMO8IeT2H0qPvwBQtGk8CYuYlvkzWAh6eAL9VfyWLOqgkRnfUMR9EnFc38cByYjOZONDJJHEnAvJwfjbSQVukoxqOfdF+Pvxu+bfzDnZBAptKGAYxxw423gPqqAKieSvRWuI/kkyDxL6ni3rkXg6r6sSOjpcSu/eVDk+Sl1B3F8cQws5lkMnTD5akn+WkjYxLCjrnmvUs-----END CERTIFICATE-----​

VeriSign Class 3 Secure Server CA – G3

JavaScript
 
-----BEGIN CERTIFICATE-----MIIF7DCCBNSgAwIBAgIQbsx6pacDIAm4zrz06VLUkTANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMTAwMjA4MDAwMDAwWhcNMjAwMjA3MjM1OTU5WjCBtTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEvMC0GA1UEAxMmVmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxh4QfwgxF9byrJZenraI+nLr2wTm4i8rCrFbG5btljkRPTc5v7QlK1K9OEJxoiy6Ve4mbE8riNDTB81vzSXtig0iBdNGIeGwCU/m8f0MmV1gzgzszChew0E6RJK2GfWQS3HRKNKEdCuqWHQsV/KNLO85jiND4LQyUhhDKtpo9yus3nABINYYpUHjoRWPNGUFP9ZXse5jUxHGzUL4os4+guVOc9cosI6n9FAboGLSa6Dxugf3kzTU2s1HTaewSulZub5tXxYsU5w7HnO1KVGrJTcW/EbGuHGeBy0RVM5l/JJs/U0V/hhrzPPptf4H1uErT9YU3HLWm0AnkGHs4TvoPAgMBAAGjggHfMIIB2zA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTASBgNVHRMBAf8ECDAGAQH/AgEAMHAGA1UdIARpMGcwZQYLYIZIAYb4RQEHFwMwVjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAqBggrBgEFBQcCAjAeGhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB/wQEAwIBBjBtBggrBgEFBQcBDARhMF+hXaBbMFkwVzBVFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBSP5dMahqyNjmvDz4Bq1EgYLHsZLjAlFiNodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvLmdpZjAoBgNVHREEITAfpB0wGzEZMBcGA1UEAxMQVmVyaVNpZ25NUEtJLTItNjAdBgNVHQ4EFgQUDURcFlNEwYJ+HSCrJfQBY9i+eaUwHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwDQYJKoZIhvcNAQEFBQADggEBAAyDJO/dwwzZWJz+NrbrioBL0aP3nfPMU++CnqOh5pfBWJ11bOAdG0z60cEtBcDqbrIicFXZIDNAMwfCZYP6j0M3m+oOmmxw7vacgDvZN/R6bezQGH1JSsqZxxkoor7YdyT3hSaGbYcFQEFn0Sc67dxIHSLNCwuLvPSxe/20majpdirhGi2HbnTTiN0eIsbfFrYrghQKlFzyUOyvzv9iNw2tZdMGQVPtAhTItVgooazgW+yzf5VK+wPIrSbb5mZ4EkrZn0L74ZjmQoObj49nJOhhGbXdzbULJgWOw27EyHW4Rs/iGAZeqa6ogZpHFt4MKGwlJ7net4RYxh84HqTEy2Y=-----END CERTIFICATE-----  ​

VeriSign Class 3 Public Primary Certification Authority – G5:

JavaScript
 
-----BEGIN CERTIFICATE-----MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbext0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/NIeWiu5T6CUVAgMBAAGjgbIwga8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFH/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBBQUAA4IBAQCTJEowX2LP2BqYLz3q3JktvXf2pXkiOOzEp6B4Eq1iDkVwZMXnl2YtmAl+X6/WzChl8gGqCBpH3vn5fJJaCGkgDdk+bW48DW7Y5gaRQBi5+MHt39tBquCWIMnNZBU4gcmU7qKEKQsTb47bDN0lAtukixlE0kF6BWlKWE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8NhnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq-----END CERTIFICATE-----​

Answer

Updates:

I’ve never been an expert at this matter, the following is only a workaround and might not be secure, use it at your own risk
This post is 3+ years old, so it may be outdated by now (code will not compile) but you should find be able to find the updated approach or official docs saying certain parts are deprecated or removed

Thank noloader for pointing me in the correction direction. I solved my issue using the following:

String keyStoreType = KeyStore.getDefaultType();
            KeyStore keyStore = KeyStore.getInstance(keyStoreType);
            keyStore.load(null, null);
            keyStore.setCertificateEntry("ca", ca);// my question shows how to get 'ca'
TrustManagerFactory tmf = TrustManagerFactory.getInstance(
    TrustManagerFactory.getDefaultAlgorithm());
// Initialise the TMF as you normally would, for example:
tmf.init(ca); 

TrustManager[] trustManagers = tmf.getTrustManagers();
final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0];

TrustManager[] wrappedTrustManagers = new TrustManager[]{
   new X509TrustManager() {
       public java.security.cert.X509Certificate[] getAcceptedIssuers() {
          return origTrustmanager.getAcceptedIssuers();
       }

       public void checkClientTrusted(X509Certificate[] certs, String authType) {
           origTrustmanager.checkClientTrusted(certs, authType);
       }

       public void checkServerTrusted(X509Certificate[] certs, String authType) {
           try {
               origTrustmanager.checkServerTrusted(certs, authType);
           } catch (CertificateExpiredException e) {
               // Do what you need to do, log to Crashlytics?
           }
       }
   }
};

SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, wrappedTrustManagers, null);
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

JavaScript
 
String keyStoreType = KeyStore.getDefaultType();            KeyStore keyStore = KeyStore.getInstance(keyStoreType);            keyStore.load(null, null);            keyStore.setCertificateEntry("ca", ca);// my question shows how to get 'ca'TrustManagerFactory tmf = TrustManagerFactory.getInstance(    TrustManagerFactory.getDefaultAlgorithm());// Initialise the TMF as you normally would, for example:tmf.init(ca); ​TrustManager[] trustManagers = tmf.getTrustManagers();final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0];​TrustManager[] wrappedTrustManagers = new TrustManager[]{   new X509TrustManager() {       public java.security.cert.X509Certificate[] getAcceptedIssuers() {          return origTrustmanager.getAcceptedIssuers();       }​       public void checkClientTrusted(X509Certificate[] certs, String authType) {           origTrustmanager.checkClientTrusted(certs, authType);       }​       public void checkServerTrusted(X509Certificate[] certs, String authType) {           try {               origTrustmanager.checkServerTrusted(certs, authType);           } catch (CertificateExpiredException e) {               // Do what you need to do, log to Crashlytics?           }       }   }};​SSLContext sc = SSLContext.getInstance("TLS");sc.init(null, wrappedTrustManagers, null);HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());  ​

Out of the 3 certificates found for the site, mentioned in my question, the one that worked for me was the VeriSign Class 3 Secure Server CA – G3

Advertisement

Answer