[GH-ISSUE #1270] Ntfy fails to verify Let's Encrypt certificate on the ISRG Root X2 chain #895

New issue

Closed

opened 2026-05-05 04:21:25 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 04:21:25 -06:00

Owner

Originally created by @m00nwtchr on GitHub (Jan 28, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1270

🐞 Describe the bug
Android app fails to connect to a ntfy server with a valid SSL certificate with a CertPathValidatorException: Trust anchor for certification path not found. error.

💻 Components impacted
Android app

🔮 Additional context
https://www.ssllabs.com/ssltest/analyze.html?d=ntfy.m00nlit.dev

Originally created by @m00nwtchr on GitHub (Jan 28, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1270 :lady_beetle: **Describe the bug** Android app fails to connect to a ntfy server with a valid SSL certificate with a `CertPathValidatorException: Trust anchor for certification path not found.` error. :computer: **Components impacted** Android app :crystal_ball: **Additional context** https://www.ssllabs.com/ssltest/analyze.html?d=ntfy.m00nlit.dev

gitea-mirror

2026-05-05 04:21:25 -06:00

closed this issue
added the
🪲 bug
label

gitea-mirror commented

2026-05-05 04:21:28 -06:00

Author

Owner

@m00nwtchr commented on GitHub (Jan 29, 2025):

Turns out Android only includes the ISRG Root X2 certificate in the trust store since Android 14, while my device runs Android 13. (https://letsencrypt.org/docs/certificate-compatibility/)

@m00nwtchr commented on GitHub (Jan 29, 2025): Turns out Android only includes the ISRG Root X2 certificate in the trust store since Android 14, while my device runs Android 13. (https://letsencrypt.org/docs/certificate-compatibility/)

gitea-mirror commented

2026-05-05 04:21:28 -06:00

Author

Owner

@m00nwtchr commented on GitHub (Jan 29, 2025):

Though, from what I understand that is still supposed to work thanks to ISRG Root X1 cross-signing ISRG Root X2's intermediaries, but not sure if there's anything I need to do on my part to make that work.

@m00nwtchr commented on GitHub (Jan 29, 2025): Though, from what I understand that is still supposed to work thanks to ISRG Root X1 cross-signing ISRG Root X2's intermediaries, but not sure if there's anything I need to do on my part to make that work.

gitea-mirror referenced this issue

2026-05-05 04:34:53 -06:00

[PR #895] [MERGED] Refined Priority header handling #1451