Android "Trust anchor for certification path not found": fixes

"Trust anchor for certification path not found" means the Android app could not link the server's certificate to any root certificate it trusts. In most real cases the server is not sending its intermediate certificate. Browsers quietly repair that; Android apps do not, so the app fails while the website looks fine.

Is it the site or your device?

It is usually the site: an incomplete chain causes most cases. Check the server's chain with the SSL checker:

curl ssl.sh/example.com

• The checker reports an incomplete chain, private CA or self-signed certificate: the server must be fixed (or, for private CAs, the app configured).
• The checker passes: check whether the failure is limited to old Android versions, specific networks (TLS inspection) or a debug setup with a user-installed CA.

Developers can confirm what the server sends:

openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null 2>/dev/null \
  | grep -E "^ *[0-9] s:"

Only a 0 s: line means the intermediate is missing.

Causes

1. Missing intermediate certificate

The server is configured with the leaf certificate only. Use the full-chain file. See missing intermediate certificate.

2. Private CA or self-signed certificate

Internal APIs and test servers often use certificates Android does not trust. Bundle the CA for that domain through a network security config, or use a public certificate.

3. User-installed CA ignored

Apps targeting API 24 or later ignore user-installed roots by default. See Android apps and user CAs.

4. Root missing on older Android

Devices that stopped receiving updates may not include newer roots. See old Android and Let's Encrypt.

5. Network interception

Corporate proxies and captive Wi-Fi portals present their own certificates, which apps reject. Test on mobile data.

What it looks like on each device

How site owners fix it

Serving the full chain, leaf plus intermediates, fixes most cases.

1. Serve the full chain.

ssl_certificate     /etc/letsencrypt/live/api.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;

If your CA delivered separate files, build the bundle with the chain builder.

2. Check every endpoint the app uses. API gateways, CDNs and load balancers each hold a copy of the certificate and chain.

3. For private CAs, add the CA to the app for that domain only (res/xml/network_security_config.xml with a <domain-config> and <certificates src="@raw/company_root"/>), never a trust-all TrustManager.

4. Verify with curl ssl.sh/example.com and on a real device running the oldest Android version you support.