See - okhttp: [TrustManagers on Android are Weird!](https://square.github.io/okhttp/5.x/okhttp/okhttp3/-ok-http-client/-builder/ssl-socket-factory.html) - https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions - https://developer.android.com/reference/javax/net/ssl/X509ExtendedTrustManager?hl=en Implementing `X509ExtendedTrustManager` allows okhttp to use `AndroidCertificateChainCleaner`.