Support user-installed certificate authorities for self-hosted servers #140

Description

The ZenNotes Android app fails to connect to a self-hosted server using HTTPS with a certificate issued by a private CA (step-ca).

The server is reachable through a browser, but the native Android app reports:

java.security.cert.CertPathValidatorException:
Trust anchor for certification path not found.

This appears to be related to Android's default behavior of not trusting user-installed certificate authorities in apps targeting modern Android versions.

Expected behavior

ZenNotes should be able to connect to self-hosted HTTPS servers whose certificate authorities are explicitly trusted by the user through Android's certificate settings.

Suggested solution

Android supports opting into user-installed CAs through a Network Security Configuration.

For example, res/xml/network_security_config.xml:

<network-security-config>
    <base-config>
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />
        </trust-anchors>
    </base-config>
</network-security-config>

Referenced from AndroidManifest.xml:

android:networkSecurityConfig="@xml/network_security_config"

This would preserve TLS certificate verification while allowing self-hosted deployments using private PKI, without requiring users to modify their Android system or rebuild the APK.

A more restrictive, opt-in approach would also be worth considering if trusting user-installed CAs globally is undesirable.

Related

• macOS desktop app fails to connect to servers using a trusted private CA zennotes#1009 — Similar certificate trust issue in the macOS desktop application, where enabling NODE_USE_SYSTEM_CA=1 resolves the connection failure.

Both issues affect users connecting to self-hosted ZenNotes servers secured with privately trusted certificate authorities.