"encountered an unknown certificate" - unexpected domain names in certificate

[working-name]

I see cert4android has encountered an unknown certificate. Do you want to trust it? every day for a good while now, without having changed the ICS url.

The URL ICSx5 tries to connect to doesn't match any of the domains listed in the x509 it complains about, which is essentially a wildcard certificate.

I'm wondering if somehow ICSx5 is resolving domains outside of VPN (running Rethink DNS) and is doing so erroneously? It happens when I let the app do its thing, but when I manually refresh in 1-2 tries it gets the right domain name and doesn't complain without me trusting anything.

This behavior makes no sense to me, I've tested and inspected the ics url with curl and a browser - it never connects to any other domain name other than the one given, and the certificate fed never mentions the domain name cert4android is complaining about.

How can I debug cert4android? Any logs anywhere?

Thanks.

[sunkup]

I see cert4android has encountered an unknown certificate. Do you want to trust it? every day for a good while now, without having changed the ICS url.

Did this happen after an ICSx5 update? Could you check whether it works with a previous version?

I'm wondering if somehow ICSx5 is resolving domains outside of VPN (running Rethink DNS) and is doing so erroneously?

ICSx5 itself should not do that to my knowledge. Maybe work manager does something for it's connectivity check before running the periodic sync worker of ICSx5 ... What is your setup? Can you provide steps for us to reproduce the issue?

How can I debug cert4android? Any logs anywhere?

ICSx5 can not export any logs, but you can connect your phone to a PC and record them yourself.

Install adb. It comes with the Android SDK, but also as a standalone package for most operating systems. To get full ICSx⁵ logs with adb logcat:

• turn on USB debugging in the developer settings of your android device
• force-quit ICSx⁵
• run adb shell setprop log.tag.icsx5 VERBOSE to set the appropriate log levels
• run adb logcat
• start ICSx⁵, force-sync (or set interval to 15 minutes and wait for the sync)

[working-name]

Thank you for the help with the debugging, much appreciated. I tried it out and I can't remember there being anything weird, it resolved as usual, then you'd get a weird cert back. It's sporadic too, so it's rather annoying to try to catch it in action.

However, what I have done is set up the same task (get request) via curl on my Linux machine. Here's the interesting part: I used 4-5 different resolvers in resolv.conf including a LAN AdGuard instance, and this thing still happens every now and then to curl.

So this is NOT ICSx5, I can only assume it's a DNS cache issue. AWS is probably cycling IPs or whatever, and while the records update you can make a request to the same IP that used to host your target, but has in the meantime changed. So you get a seemingly random smattering of certificate mismatch errors quoting differing domain names that have no rhyme or reason. There's a load balancer (CNAME
the-company-name-crap-here.us-west-2.elb.amazonaws.com) this request goes to, which then resolves to some 3 redundant A records. I emailed the company that hosts this ICS but have received no response in over half a year. Not much I can do.

Thank you once again for your help.

[sunkup]

I am sorry to hear that. Hope it sorts itself out at some point then 👍