-1

I encounter the same problem as the user has in this post: Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified?

The accepted answer is:

I don't think you can do anything about it but to upgrade your Android.

The problem here is a generic top-level domain .vip and older Android versions do not recognise them as public (hence the "a name valid only within your network" message). It's a known problem and Wikipedia lists it as one of the technical issues with these domains.

With Internet app version 4.0 on Android Marshmallow, your certificate is verified properly.

'Upgrading your android' means I should get a new mobile phone?

Some facts about my device

Application version: Chrome 73.0.3683.90
Operating system: Android 6.0.1 (Marshmallow), SM-G900F
Samsung Internet: Version 9.2.00.70

edit: status: not verified properly, obviously due to applications are unable to pull the cert info from the system trusted store?

Anyone know where I can find more information about this? Installing the certificate in the user store works but shows a network may be monitored warning message which I guess I have to live with it.

closed as unclear what you're asking by Steffen Ullrich, Xander, kalina, forest, Matthew Apr 29 at 8:46

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    While this might look like the same problem I suspect this is rather a problem with this specific site, i.e. a problem with the setup of the site not with the client. Please check this site against SSLLabs and look for problems like "incomplete chain". If you found nothing like this please provide the problematic site so that we can do a more in-depth analysis of what might be wrong. – Steffen Ullrich Apr 25 at 14:23
  • I can't check my site against SSLLabs because it's name is only valid within my local area network (IP 192.168.1.1 and hostname is ginterface.3). I want to use https on my router (running openwrt with uhttpd on it) and as far as I can see the chain is properly configured and working. Verified with openssl verify, s_clientand curl -v and got no problems with the chain or handshake so far. Https is working on all of my desktop devices and also on my mobile phone but only if I add it to user cert store. As soon as I'm moving the file to system trusted cert store it doesn't work anymore – helpexchange Apr 25 at 17:50
  • For those interested in deeper analysis I can provide my openssl certificate authority setup. Here you can find some other posts I made regarding this topic: stackoverflow.com/questions/55695626/… forum.xda-developers.com/android/help/… reddit.com/r/sysadmin/comments/benvpz/… – helpexchange Apr 25 at 18:02
  • 3
    It looks like your problem is in no way related to the one you've linked to. In the other post it is a problem with validating a certificate issued by a public CA - here it is a problem about validating a certificate from your own private CA. And it actually works if you install it the intended way via the user interface but only does not work if you fiddle around with adb and try to save it via the command line. It is hard to know what you really did (insufficient information to reproduce) but you definitely did not do it the official way. It does not look like a bug in Android to me. – Steffen Ullrich Apr 25 at 18:08
  • 1
    It is in intended feature that a certificate installed by the user causes this warning about network maybe monitored - since the installed certificate could actually be used this way. The instructions you've followed are not the official way to install a user CA. The details how this need to be done might be different between ROMs (like between stock android and Samsung ROMs) and between Android versions. This is not a bug since what you attempt is in no way a supported or official feature. – Steffen Ullrich Apr 25 at 19:18
0

'Upgrading your android' means I should get a new mobile phone?

Since your device (Samsung Galaxy S5 apparently) is out of support and won't be receiving any more updates, yes that's the easiest way.

Or, if you want to keep using your current phone, you can install a 3rd-party ROM like Lineage. You'll improve your security in general that way, as you are at least a couple years behind on Android security patches as well at this point. It's not as secure as getting a new phone, because you still won't be getting any updates to fix driver issues and similar things, but it'll be a big improvement. Bonus: you'll jump from Android Marshmallow to Pie. Although, you'll lose any Samsung-specific apps you currently use (and I'm not sure if they're available or working from the Play store).

  • 1
    For me it's more about solving a riddle than security but I think you are right. I also think I don't have to care for security in the first place due to the fact that it only affects my internal servers (not reachable from the outside internet world) for now. Tackling me for several weeks now....But anyway, if I'm bored enough maybe I'll flash a custom rom and try again, thanks. – helpexchange Apr 25 at 17:55
  • Finally managed to solve this! With the assistance of JW09I4 from XDA-Devs I was able to get it working. Here's what I did: (1) flashing my sm-g900f with odin v3.12.4-4 and latest twrp 3.3.0-0-klte (2) backup relevant data, wipe system/cache/... with twrp afterwards (3) flash 16.0-nightly-klte addonsu-16.0-arm open_gapps-arm-9.0-nano-20190428 (4) install certificate via security settings options. Shown as 'user cert' but no warning message and ssl works now :) – helpexchange Apr 29 at 13:01
  • @helpexchange No problem at all =] – JW0914 Apr 29 at 14:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.