Certificate update can't be confirmed with icsx5 version 2.4.0

[andifor]

I just installed icsx5 to version 2.4.0 and updated the certificate of my calendar server.

• I used to be able to accept the certificate by ticking a checkbox
• I do see the error message about a certificate mismatch, but I don't see a checkbox for ticking it => I'm not able to sync my calendar, there is no visible way around the error message

This is reproducible with icsx5 version 2.4.0.
Downgrading to version 2.3.1, I see the checkbox and can tick it

Q: what has changed in regard to certificates?
Q: is this a expected behaviour change?

I consider this a bug and stay with version 2.3.1

[sezuan]

Same here, this url stopped to work:

https://waste.awb-landkreis-karlsruhe.de/WasteManagementKarlsruheHaushalteBlank/WasteManagementServiceServlet ...

Complains about:

java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
	at org.conscrypt.SSLUtils.toSSLHandshakeException(SourceFile:361)
	at org.conscrypt.ConscryptEngine.convertException(SourceFile:1138)
	at org.conscrypt.ConscryptEngine.readPlaintextData(SourceFile:1093)
	at org.conscrypt.ConscryptEngine.unwrap(SourceFile:880)
	at org.conscrypt.ConscryptEngine.unwrap(SourceFile:751)
	at org.conscrypt.ConscryptEngine.unwrap(SourceFile:716)
	at org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(SourceFile:833)
	at org.conscrypt.ConscryptEngineSocket$SSLInputStream.access$100(SourceFile:706)
	at org.conscrypt.ConscryptEngineSocket.doHandshake(SourceFile:230)
	at org.conscrypt.ConscryptEngineSocket.startHandshake(SourceFile:209)
	at okhttp3.internal.connection.ConnectPlan.connectTls(SourceFile:355)
	at okhttp3.internal.connection.ConnectPlan.connectTlsEtc(SourceFile:210)
	at okhttp3.internal.connection.FastFallbackExchangeFinder.find(SourceFile:78)
	at okhttp3.internal.connection.RealCall.initExchange$okhttp(SourceFile:280)
	at okhttp3.internal.connection.ConnectInterceptor.intercept(SourceFile:32)
	at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:126)
	at okhttp3.internal.cache.CacheInterceptor.intercept(SourceFile:101)
	at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:126)
	at okhttp3.internal.http.BridgeInterceptor.intercept(SourceFile:85)
	at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:126)
	at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(SourceFile:74)
	at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:126)
	at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(SourceFile:208)
	at okhttp3.internal.connection.RealCall$AsyncCall.run(SourceFile:530)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1156)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:651)
	at java.lang.Thread.run(Thread.java:1119)
Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
	at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:649)
	at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:498)
	at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:418)
	at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:346)
	at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)
	at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:90)
	at org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(SourceFile:156)
	at java.lang.reflect.Method.invoke(Native Method)
	at org.conscrypt.Platform.checkTrusted(SourceFile:388)
	at org.conscrypt.Platform.checkServerTrusted(SourceFile:434)
	at org.conscrypt.ConscryptEngine.verifyCertificateChain(SourceFile:1643)
	at org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
	at org.conscrypt.NativeSsl.readDirectByteBuffer(SourceFile:567)
	at org.conscrypt.ConscryptEngine.readPlaintextDataDirect(SourceFile:1099)
	at org.conscrypt.ConscryptEngine.readPlaintextData(SourceFile:1083)
	... 24 more
Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
	... 39 more

Certificate is accepted in Chrome and Firefox.

[sunkup]

Thanks for reporting! We'll track this in #692 and try to fix it asap.