Note
This is an automated response from a bot acting on maria's behalf. This issue has had no activity since 2026-08-07. Is it still relevant on the current version? If so, your version and OS would help.
[Bug]: Android app does not trust user-installed CA certificates#5639
Before submitting
- I searched existing issues and did not find a duplicate.
- I included enough detail to reproduce or investigate the problem.
Area
apps/mobile
Steps to reproduce
- Stand up a T3 Code server behind an internal CA (in my case stepCA), so it serves HTTPS with a cert chaining to a private root.
- Install that root cert on the Android device under Settings → Security → Encryption & credentials → Install a certificate → CA certificate. It lands in User credentials, not System.
- Confirm the cert is trusted by the system by opening
https://private.ca.com/.well-known/t3/environmentin Chrome on the same device. It loads without a warning. - Open the T3 Code Android app → Add environment.
- Enter Host:
https://private.ca.comand the pairing code. - Tap + ADD ENVIRONMENT.
Expected behavior
The app should reach the environment endpoint and pair, the same way Chrome on the same device does, since the CA is installed and trusted at the OS level.
Actual behavior
Pairing fails immediately with:
| 1 | Failed to fetch remote environment endpoint https://private.ca.com/.well-known/t3/environment (HttpClientError: Transport error (GET https://private.ca.com/.well-known/t3/environment)). |
The error is generic, so it does not read as a TLS problem at first. From the app side there is nothing distinguishing a rejected chain from the host being unreachable.
Digging through the repo, my guess would be this is the stock Android trust policy rather than anything specific to the pairing flow:
- There is no
network_security_config.xmlanywhere inapps/mobile, and noandroid:networkSecurityConfigattribute on the manifest<application>element. - With no config, API 24+ defaults to system CAs only. User-installed CAs are ignored for app traffic. RN/Expo min and target SDK are both in that range.
- The only Android networking change in the config plugins is cleartext, which is a separate switch and does not affect trust anchors:
js
| 1 | // apps/mobile/plugins/withAndroidCleartextTraffic.cjs |
| 2 | const { withAndroidManifest } = require("expo/config-plugins"); |
| 3 | module.exports = function withAndroidCleartextTraffic(config) { |
| 4 | return withAndroidManifest(config, (nextConfig) => { |
| 5 | // ... |
| 6 | application.$["android:usesCleartextTraffic"] = "true"; |
| 7 | return nextConfig; |
| 8 | }); |
| 9 | }; |
- There is no custom TrustManager, OkHttp cert pinning, or custom SSL stack, so HTTPS/WSS goes React Native → OkHttp → platform TLS with the default anchors.
iOS does not have the same problem because NSAllowsArbitraryLoads: true is set there. Android has no equivalent flag for user CAs, it has to be done through a network security config.
So in practice: system or public CA works, http:// and ws:// work because cleartext is permitted, and a user-installed CA fails the handshake.
Impact
Major degradation or frequent failure
Version or commit
T3 Code Android 1.0.1, installed from Google Play
Environment
Samsung Android 15, stepCA-issued server cert, root installed under Settings → Security → User credentials
Logs or stack traces
shell
| 1 | Failed to fetch remote environment endpoint https://private.ca.com/.well-known/t3/environment (HttpClientError: Transport error (GET https://private.ca.com/.well-known/t3/environment)). |
| 2 | |
| 3 | |
| 4 | The same URL returns 200 in Chrome on the same device with the same cert installed. |
Screenshots, recordings, or supporting files
No response
Workaround
Add a network security config that includes the user trust anchors, and wire it up through an Expo config plugin alongside the existing cleartext one:
xml
| 1 | <base-config cleartextTrafficPermitted="true"> |
| 2 | <trust-anchors> |
| 3 | <certificates src="system" /> |
| 4 | <certificates src="user" /> |
| 5 | </trust-anchors> |
| 6 | </base-config> |
Inspected current main at ed9b7ca9c5. The mobile Android plugin still only sets usesCleartextTraffic; no network security config or user trust anchors were found. This supports the reported cause but is not a runtime reproduction. This Linux triage environment has neither adb nor an Android emulator, so the Android 15 private-CA pairing flow remains unverified. Changing certificate trust policy requires maintainer review under the automated triage rules. Leaving this open for that review; no fix PR created.