Trust anchor for certification path not found.

Crowdin Issues
1

We are getting below error on some older Android devices. Please check and resolve the issue

End point: https://distributions.crowdin.net/af86ab4572166a78334a6f9ldx4/manifest.json

Platform: .NET MAUI

System.Net.Http.HttpRequestException: Connection failure

- → Javax.Net.Ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

- → Java.Security.Cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

- → Java.Security.Cert.CertPathValidatorException: Trust anchor for certification path not found.

— End of managed Java.Security.Cert.CertPathValidatorException stack trace —

2

Hi @sateeshtaddi , this is a device-side trust store issue, not a Crowdin problem. The error Trust anchor for certification path not found means the older Android device doesn’t have the root CA that signed distributions.crowdin.net’s certificate. Crowdin platform status is fully green and the cert chain itself is valid — modern devices/browsers/clients connect fine.

Why older Android devices fail

distributions.crowdin.net is served behind a CDN (CloudFront), and the certificate chain terminates at a root CA that older Android trust stores don’t include:

  • Android 7.1.1 (API 25) and earlier — their built-in trust stores were last meaningfully updated by Google around 2017 and never received newer roots (Amazon Trust Services / ISRG Root X1 / etc.).

  • They can’t validate the chain, so the TLS handshake aborts with this exact exception.

  • The cross-signed bridge that used to keep these devices working (DST Root CA X3 from IdenTrust) expired on 2021-09-30, which is the moment a lot of these “it used to work” reports started.

    Fixes possible

  1. Update the device OS (best fix, often not possible on locked-down hardware).

  2. Bundle a current CA store inside the .NET MAUI app. The platform’s HttpClient on Android delegates trust to the OS by default; you can override it to use a pinned/bundled trust store via:

    • AndroidMessageHandler with a SSLContext initialized from a bundled BKS/PKCS12 trust store, OR

    • BouncyCastle + custom HttpClientHandler to handle cert validation in managed code.

    • The Mozilla CA bundle (cacert.pem) shipped with the app and loaded into a custom TrustManager is the common pattern.

  3. Switch from AndroidClientHandler to SocketsHttpHandler in your MAUI project. SocketsHttpHandler runs the TLS stack in .NET (not the Android OS), so it uses the .NET runtime’s bundled trust store instead of the device’s outdated one. Set it via:falsein the Android csproj, and configure HttpClient to use SocketsHttpHandler. This is the cleanest fix for most MAUI apps and avoids shipping your own cert bundle.

  4. Network Security Config (res/xml/network_security_config.xml) to trust additional CAs — but this requires API 24+ anyway and is mostly used for adding custom CAs, not fixing missing public roots.