# Android "Trust anchor for certification path not found": fixes

> Android apps throw "Trust anchor for certification path not found" when the server chain can't reach a trusted root. Usually a missing intermediate.

Source: https://ssl.sh/errors/android-trust-anchor-not-found/
Last updated: 2026-11-10

**"Trust anchor for certification path not found" means the Android app could not link the server's certificate to any root certificate it trusts.** In most real cases the server is not sending its intermediate certificate. Browsers quietly repair that; Android apps do not, so the app fails while the website looks fine.

## Is it the site or your device?

It is usually the site: an incomplete chain causes most cases. Check the server's chain with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

- **The checker reports an incomplete chain, private CA or self-signed certificate:** the server must be fixed (or, for private CAs, the app configured).
- **The checker passes:** check whether the failure is limited to old Android versions, specific networks (TLS inspection) or a debug setup with a user-installed CA.

Developers can confirm what the server sends:

```bash
openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null 2>/dev/null \
  | grep -E "^ *[0-9] s:"
```

Only a `0 s:` line means the intermediate is missing.

## Causes

### 1. Missing intermediate certificate

The server is configured with the leaf certificate only. Use the full-chain file. See [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/).

### 2. Private CA or self-signed certificate

Internal APIs and test servers often use certificates Android does not trust. Bundle the CA for that domain through a network security config, or use a public certificate.

### 3. User-installed CA ignored

Apps targeting API 24 or later ignore user-installed roots by default. See [Android apps and user CAs](https://ssl.sh/errors/android-app-user-ca-not-trusted/).

### 4. Root missing on older Android

Devices that stopped receiving updates may not include newer roots. See [old Android and Let's Encrypt](https://ssl.sh/errors/old-android-lets-encrypt-error/).

### 5. Network interception

Corporate proxies and captive Wi-Fi portals present their own certificates, which apps reject. Test on mobile data.

## What it looks like on each device

| Context | What you see |
|---|---|
| Android app logs | `javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.` |
| Chrome on Android | Often loads the site normally |
| Java on servers | [PKIX path building failed](https://ssl.sh/errors/java-pkix-path-building-failed/) |
| iOS apps | `NSURLErrorDomain Code=-1202` |

## How site owners fix it

Serving the full chain, leaf plus intermediates, fixes most cases.

**1. Serve the full chain.**

```nginx
ssl_certificate     /etc/letsencrypt/live/api.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
```

If your CA delivered separate files, build the bundle with the [chain builder](https://ssl.sh/tools/chain-builder/).

**2. Check every endpoint the app uses.** API gateways, CDNs and load balancers each hold a copy of the certificate and chain.

**3. For private CAs,** add the CA to the app for that domain only (`res/xml/network_security_config.xml` with a `<domain-config>` and `<certificates src="@raw/company_root"/>`), never a trust-all TrustManager.

**4. Verify** with `curl ssl.sh/example.com` and on a real device running the oldest Android version you support.