Open kennsippell opened 4 months ago
Just to rule out the obvious, what webview version are you running?
When exactly was the certificate installed? I have seen it take days for the new cert to start being used and it could just be a matter of time.
Can you try with a device that doesn't have the app, or clear data for your app, or wipe the app on your device and reinstall, and see if that flushes the cache?
All other instances load fine through the Android app, so I doubt it is webview version. You can view the certificate at https://kericho.echis.go.ke/ I installed the app fresh to reproduce this. I have cleared data and can reproduce it again and again. The page loads fine on the same device in chrome.
All other instances load fine through the Android app, so I doubt it is webview version.
Right but the difference might be how the cert was generated so it is relevant.
The page loads fine on the same device in chrome.
Android manages Chrome and Webview separately so they are often on different versions.
@garethbowen Did you try this on your device with the steps provided and it isn't reproducing?
No unfortunately I don't have time to commit to this today, but just trying to help out with the few tips I have.
Webview is 123.0.06312.118 Chrome is 124.0.06367.82
Kericho has been inaccessible for 15 days. Can you help get this prioritized?
If we were seeing the old cert, I'd expect an expirty error but since I'm seeing this error about a trust anchor.
2024-04-25 13:55:40.452 7744-7827 cr_X509Util org...webapp.mobile.moh_kenya_echis I Failed to validate the certificate chain, error: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
2024-04-25 13:55:40.463 7744-7837 chromium org...webapp.mobile.moh_kenya_echis E [ERROR:ssl_client_socket_impl.cc(970)] handshake failed; returned -1, SSL error code 1, net_error -202
2024-04-25 13:55:40.487 1743-2410 ConnectivityService system_server D NetReassign [no changes] [c 2] [a 3] [i 8]
2024-04-25 13:55:40.536 7744-7837 chromium org...webapp.mobile.moh_kenya_echis E [ERROR:ssl_client_socket_impl.cc(970)] handshake failed; returned -1, SSL error code 1, net_error -202
The certificate for Kericho is weak rated B here. I'll work to fix this certificate, but cht-android should not show a white screen after these CertPathValidatorException
I'm able to reproduced this error on kericho.echis.go.ke
, just as Kenn's video shows. However, when I go to the Unbranded App (this APK), I and manually enter the URL, I actually get a different error:
If possible, this ticket should make the Unable to contact server
more accurate. I'd say both should say Error: xxx
. This way the end user knows they can't proceed and we can add on Error: invalid TLS certificate
along with existing errors.
Note that eventually kericho.echis.go.ke will be fixed and we won't be able to test with it. Bad SSL (badssl.com) is a GREAT resource for all your TLS testing needs. We can use incomplete-chain.badssl.com to test an incomplete chain when kericho gets fixed.
Describe the bug
To Reproduce Steps to reproduce the behavior:
Expected behavior Kericho is working in my browser on the phone, but doesn't load through the app All other eCHIS domains appear to be working as expected Kericho was working fine until they updated their TSL cert
Logs
Screenshots https://github.com/medic/cht-android/assets/9014751/7896ef70-4a6c-4d11-87a8-579e0c735146
Environment
Additional context Add any other context about the problem here. What have you tried? Is there a workaround?