diff --git a/FAQ.md b/FAQ.md index 1c7ae12744..8d95042157 100644 --- a/FAQ.md +++ b/FAQ.md @@ -627,7 +627,7 @@ This can be caused by using an incorrect host name, so first double-check the ho Please see the documentation of the email provider about the right host name. Sometimes the right host name is in the error message. -Another possible cause is [Certificate transparency](https://github.com/appmattus/certificatetransparency) failing, so try disabling it in the connection settings tab page. +~~Another possible cause is [Certificate transparency](https://github.com/appmattus/certificatetransparency) failing, so try disabling it in the connection settings tab page.~~ You should try to fix this by contacting your provider or by getting a valid security certificate because invalid security certificates are insecure and allow [man-in-the-middle attacks](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). @@ -648,6 +648,7 @@ This will "pin" the server certificate to prevent man-in-the-middle attacks. Note that older Android versions might not recognize newer certification authorities like Let’s Encrypt causing connections to be considered insecure, see also [here](https://developer.android.com/training/articles/security-ssl). +In such cases, you can install the required root/intermediate certificates, for example, the often used [Let's encrypt root certificates](https://letsencrypt.org/ca/certificates/).
diff --git a/index.html b/index.html index 38e914c0a1..37af78fb4c 100644 --- a/index.html +++ b/index.html @@ -562,7 +562,7 @@ Therefore, this issue can only be resolved by your email provider, or by installing the GitHub version of the app (as an update) and enabling insecure connections in the account/identity settings.** -->

… Untrusted … not in certificate …
… Untrusted … Unacceptable certificate …
… Invalid security certificate (Can’t verify identity of server) …
… Chain validation failed … timestamp check failed … Certificate expired at …

This can be caused by using an incorrect host name, so first double-check the host name in the advanced identity/account settings (tap Manual setup and account options). Please see the documentation of the email provider about the right host name. Sometimes the right host name is in the error message.

-

Another possible cause is Certificate transparency failing, so try disabling it in the connection settings tab page.

+

Another possible cause is Certificate transparency failing, so try disabling it in the connection settings tab page.

You should try to fix this by contacting your provider or by getting a valid security certificate because invalid security certificates are insecure and allow man-in-the-middle attacks. If money is an obstacle, you can get free security certificates from Let’s Encrypt.

The quick, but unsafe solution (not advised), is to enable Insecure connections in the advanced identity settings (navigation menu, tap Settings, tap Manual setup, tap Identities, tap the identity, tap Advanced).

Alternatively, you can accept the fingerprint of invalid server certificates like this:

@@ -574,7 +574,7 @@ or by installing the GitHub version of the app (as an update) and enabling insec
  • Tick the checkbox below the error message and save again

    • This will “pin” the server certificate to prevent man-in-the-middle attacks.

    -

    Note that older Android versions might not recognize newer certification authorities like Let’s Encrypt causing connections to be considered insecure, see also here.

    +

    Note that older Android versions might not recognize newer certification authorities like Let’s Encrypt causing connections to be considered insecure, see also here. In such cases, you can install the required root/intermediate certificates, for example, the often used Let’s encrypt root certificates.


    Trust anchor for certification path not found

    … java.security.cert.CertPathValidatorException: Trust anchor for certification path not found … means that the default Android trust manager was not able to verify the server certificate chain.