"encountered an unknown certificate" - unexpected domain names in certificate

[working-name]

I see cert4android has encountered an unknown certificate. Do you want to trust it? every day for a good while now, without having changed the ICS url.

The URL ICSx5 tries to connect to doesn't match any of the domains listed in the x509 it complains about, which is essentially a wildcard certificate.

I'm wondering if somehow ICSx5 is resolving domains outside of VPN (running Rethink DNS) and is doing so erroneously? It happens when I let the app do its thing, but when I manually refresh in 1-2 tries it gets the right domain name and doesn't complain without me trusting anything.

This behavior makes no sense to me, I've tested and inspected the ics url with curl and a browser - it never connects to any other domain name other than the one given, and the certificate fed never mentions the domain name cert4android is complaining about.

How can I debug cert4android? Any logs anywhere?

Thanks.

[sunkup]

I see cert4android has encountered an unknown certificate. Do you want to trust it? every day for a good while now, without having changed the ICS url.

Did this happen after an ICSx5 update? Could you check whether it works with a previous version?

I'm wondering if somehow ICSx5 is resolving domains outside of VPN (running Rethink DNS) and is doing so erroneously?

ICSx5 itself should not do that to my knowledge. Maybe work manager does something for it's connectivity check before running the periodic sync worker of ICSx5 ... What is your setup? Can you provide steps for us to reproduce the issue?

How can I debug cert4android? Any logs anywhere?

ICSx5 can not export any logs, but you can connect your phone to a PC and record them yourself.

Install adb. It comes with the Android SDK, but also as a standalone package for most operating systems. To get full ICSx⁵ logs with adb logcat:

• turn on USB debugging in the developer settings of your android device
• force-quit ICSx⁵
• run adb shell setprop log.tag.icsx5 VERBOSE to set the appropriate log levels
• run adb logcat
• start ICSx⁵, force-sync (or set interval to 15 minutes and wait for the sync)