[GH-ISSUE #1270] Ntfy fails to verify Let's Encrypt certificate on the ISRG Root X2 chain #897

New issue

Closed

opened 2026-05-07 00:28:34 +02:00 by BreizhHardware · 2 comments

BreizhHardware commented

2026-05-07 00:28:34 +02:00

Owner

Originally created by @m00nwtchr on GitHub (Jan 28, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1270

🐞 Describe the bug
Android app fails to connect to a ntfy server with a valid SSL certificate with a CertPathValidatorException: Trust anchor for certification path not found. error.

💻 Components impacted
Android app

🔮 Additional context
https://www.ssllabs.com/ssltest/analyze.html?d=ntfy.m00nlit.dev

Originally created by @m00nwtchr on GitHub (Jan 28, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1270 :lady_beetle: **Describe the bug** Android app fails to connect to a ntfy server with a valid SSL certificate with a `CertPathValidatorException: Trust anchor for certification path not found.` error. :computer: **Components impacted** Android app :crystal_ball: **Additional context** https://www.ssllabs.com/ssltest/analyze.html?d=ntfy.m00nlit.dev

BreizhHardware

2026-05-07 00:28:34 +02:00

closed this issue
added the
🪲 bug
label

BreizhHardware commented

2026-05-07 00:28:34 +02:00

Author

Owner

@m00nwtchr commented on GitHub (Jan 29, 2025):

Turns out Android only includes the ISRG Root X2 certificate in the trust store since Android 14, while my device runs Android 13. (https://letsencrypt.org/docs/certificate-compatibility/)

@m00nwtchr commented on GitHub (Jan 29, 2025): Turns out Android only includes the ISRG Root X2 certificate in the trust store since Android 14, while my device runs Android 13. (https://letsencrypt.org/docs/certificate-compatibility/)

BreizhHardware commented

2026-05-07 00:28:34 +02:00

Author

Owner

@m00nwtchr commented on GitHub (Jan 29, 2025):

Though, from what I understand that is still supposed to work thanks to ISRG Root X1 cross-signing ISRG Root X2's intermediaries, but not sure if there's anything I need to do on my part to make that work.

@m00nwtchr commented on GitHub (Jan 29, 2025): Though, from what I understand that is still supposed to work thanks to ISRG Root X1 cross-signing ISRG Root X2's intermediaries, but not sure if there's anything I need to do on my part to make that work.