Android Studio: Server's certificate is not trusted

Question

Is it safe to ignore this warning? It shows up when I create a new project in Android Studio:

Server's certificate is not trusted

Certificate details

Issued To

CN (Common Name)       *.google.com
O (Organization)       Google Inc
L (Locality)           Mountain View
C (Country)            US
ST (State or Province) California

Issued By

CN (Common Name)       Google Internet Authority G2
O (Organization)       Google Inc
C (Country)            US

Validity Period

Valid from:            9/24/14
Valid until:           12/23/14

...

The date looks alright and I checked my computer's date settings to be sure. Why else would it be "not trusted"?

Answer 1

Android Studio has a configuration for Server Certificates (This works for other IntelliJ platforms like PyCharm as well)

Go to File->Settings. In the IDE Settings section select Server Certificates

NOTE: Newer IntelliJ it is in File->Settings->Tools->Server Certificates as mentioned in the comments.

Myself I just selected the Accept Automatically check box, hit Apply and never had to deal with it. If you are worried about security, there is also the option to add them 1 at a time as they come up.

In my case I did this because I already had a *.google.com certificate configured as accepted, but I still got the popup. I suspect that the fingerprint changed and if I would have deleted and then accepted the error would have gone away, but I decided to just make it go away by selecting the check box.

Answer 2

It is not safe to ignore that warning. Someone could be attempting a man-in-the-middle attack with a fake certificate in order to install malicious software on your computer through the update process. This probably isn't happening but it's always better to do things correctly when it comes to security.

You should instead add root certificates you trust to the Android Studio keystore. The location and default password of the keystore should be listed at the bottom of that warning. For example, mine is at ~/Library/Caches/AndroidStudio/tasks/cacerts. Next you'll want to find the root certificate in the chain the server is presenting. Unfortunately the warning doesn't list the whole chain so it takes a little work to find it. The Google Internet Authority G2 certificate is the same one that is used to sign the certificates for google's sites. You can view the chain in Chrome by going to google.com, clicking on the green lock, then "Certificate Information" in the connection tab. At this point you can verify that the hashes in the warning match the hashes for the real G2 certificate. You'll also see that the root certificate is named Equifax Secure Certificate Authority. You can download it from https://www.geotrust.com/resources/root-certificates/. Next you'll need to add it to the keystore:

keytool -import -alias equifaxca \
-file Equifax_Secure_Certificate_Authority.pem -keystore cacerts

Finally, restart Android Studio. That warning should not appear again until August 22, 2018 unless someone is actually presenting a fake certificate.

Answer 3

I ran into this problem after adding a maven repository with SSL certificate signed by non-standard Certificate Authority (CA).

When running the gradle build for my project from my command line, everything worked fine (I had added the custom CA to my machine Java installation cacerts). I had problem running the build from Android studio however, and was getting errors like this:

> Could not resolve joda-time:joda-time:2.9.9.
  > Could not get resource 'https://custom-maven-repo.com/repository/releases/joda-time/joda-time/2.9.9/joda-time-2.9.9.pom'.
    > Could not GET 'https://custom-maven-repo.com/repository/releases/joda-time/joda-time/2.9.9/joda-time-2.9.9.pom''.
      > sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        > PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          > unable to find valid certification path to requested target

I downloaded the pem file for the custom CA, called my-ca.pem. I tried adding this to Android Studio in Preferences -> Tools -> Server Certificates, but that didn't fix it.

I noticed that Android Studio uses an embedded JDK (File -> Project Structure -> SDK Location -> JDK Location) at /Applications/Android Studio.app/Contents/jre/jdk/Contents/Home. In order to get the certificate accepted, I ran (on Mac OS X) these commands to add the certificate, then kill the Android Studio java process:

/Applications/Android\ Studio.app/Contents/jre/jdk/Contents/Home/bin/keytool -import -alias my-ca -keystore /Applications/Android\ Studio.app/Contents/jre/jdk/Contents/Home/jre/lib/security/cacerts -storepass changeit -file path/to/my-ca.pem -noprompt
kill -9 $(ps -A | grep java | grep "Android Studio" | grep -v grep | awk '{print $1}')

Running the gradle build from Android Studio then worked.

An alternative solution is to set up Android Studio to use a custom JDK using on your machine which has the CA certificate installed, using the menu in File -> Project Structure -> SDK Location -> JDK Location

Answer 4

For Mac Operating System it is in the menu Android Studio->Preferences->Tools->Server Certificates.

In the top of the right side window select the checkbox Accept non-trusted certificates automatically. Hit apply and ok.

Answer 5

As of AndroidStudio 1.5.1 You can go to Preferences -> Tools -> Server Certificates and click the + button to manually add certificates that should be trusted.