For my own setup I use a personal CA: "Gert van Dijk CA". I'm using this for HTTPS and VPN successfully by importing the CA certificate into the Android keystore. I'm having trouble getting the Email app recognize this. Here are some notes about the current setup:
- The custom CA is listed perfectly fine in Settings -> Security -> Trusted Credentials -> User.
- Chrome and "OpenVPN for Android" are working with this custom CA. I can see a green location bar when connecting to
This all looks good, until I come to setting up my Exchange mail. It simply won't connect to
mail.mydomain.tld with the error "Couldn't open connection to server". However, when I change "Security Type: SSL/TLS" to "SSL/TLS (Accept all certificates)" it will sync my mail just fine! This makes me believe the stock Email app isn't taking the user credentials in the key store into account. Why?
Logcat shows me this line when receiving the connection error:
I/Exchange(10278): IOException while sending request: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
To verify I've set up my Exchange server correctly, I navigated to
https://mail.mydomain.tld/Microsoft-Server-ActiveSync and the location bar is perfectly green!
How can I make the Email app take the user trusted credentials into account here? I don't want to trust all possible certificates for security reasons.
Android versions: 4.4 (Nexus 5), 4.3 (Nexus 7 2013).