trust anchor for certification path not found #1779

New Issue

2025-11-07T07:18:06-06:00

GiteaMirror commented

2025-11-07 07:18:06 -06:00

Originally created by @hughware on GitHub (Nov 28, 2023).

Subject of the issue

android: trust anchor for certification path not found

Deployment environment

vaultwarden version: latest

Install method: docker image
Clients used:Android
Reverse proxy and version:nginx
MySQL/MariaDB or PostgreSQL version:default
Other relevant details:

Steps to reproduce

docker-compose

name: vaultwarden
services:
    server:
        container_name: vaultwarden
        volumes:
            - ./data/:/data/
        restart: unless-stopped
        environment:
            - ADMIN_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxx
        ports:
            - 55555:80
        image: vaultwarden/server:latest

docker-compose -f vaultwarden.yml up -d

nginx-crt
san.cnf

[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
C = US
ST = State
L = City
O = Organization
CN = CN

[req_ext]
subjectAltName = @alt_names

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = example.com
DNS.2 = *.example.com

openssl ecparam -genkey -name prime256v1 -noout -out ec.key
openssl req -x509 -nodes -key my.key -out ec.crt -config san.cnf -days 365

nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    proxy_cache_path /opt/cache levels=1:2 keys_zone=my_cache:10m max_size=1g inactive=60m use_temp_path=off;
server {
    listen 55552 ssl http2; 
    server_name localhost;

    ssl_certificate /etc/nginx/ssl/ec.crt;
    ssl_certificate_key /etc/nginx/ssl/ec.key;

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    }

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass http://127.0.0.1:55555;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;


        proxy_cache my_cache;
        proxy_cache_valid 200 302 60m;
        proxy_cache_valid 404 1m;

        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
    }
}

systemctl enable nginx --now

Expected behaviour

web -> https://ip:55552 OK
android -> https://ip:55552 OK

Actual behaviour

web -> https://ip:55552 OK It's slow to load
android -> https://ip:55552 Popup dialog 'trust anchor for certification path not found'

Troubleshooting data

Originally created by @hughware on GitHub (Nov 28, 2023).   ### Subject of the issue android: trust anchor for certification path not found  ### Deployment environment     * vaultwarden version: latest  * Install method: docker image * Clients used:Android  * Reverse proxy and version:nginx  * MySQL/MariaDB or PostgreSQL version:default  * Other relevant details: ### Steps to reproduce  - docker-compose ```docker name: vaultwarden services: server: container_name: vaultwarden volumes: - ./data/:/data/ restart: unless-stopped environment: - ADMIN_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxx ports: - 55555:80 image: vaultwarden/server:latest ``` docker-compose -f vaultwarden.yml up -d - nginx-crt san.cnf ```bash [req] distinguished_name = req_distinguished_name req_extensions = req_ext x509_extensions = v3_req prompt = no [req_distinguished_name] C = US ST = State L = City O = Organization CN = CN [req_ext] subjectAltName = @alt_names [v3_req] subjectAltName = @alt_names [alt_names] DNS.1 = example.com DNS.2 = *.example.com ``` ```bash openssl ecparam -genkey -name prime256v1 -noout -out ec.key openssl req -x509 -nodes -key my.key -out ec.crt -config san.cnf -days 365 ``` - nginx.conf ```bash user nginx; worker_processes auto; error_log /var/log/nginx/error.log; pid /run/nginx.pid; # Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. include /usr/share/nginx/modules/*.conf; events { worker_connections 1024; } http { log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 4096; include /etc/nginx/mime.types; default_type application/octet-stream; # Load modular configuration files from the /etc/nginx/conf.d directory. # See http://nginx.org/en/docs/ngx_core_module.html#include # for more information. include /etc/nginx/conf.d/*.conf; proxy_cache_path /opt/cache levels=1:2 keys_zone=my_cache:10m max_size=1g inactive=60m use_temp_path=off; server { listen 55552 ssl http2; server_name localhost; ssl_certificate /etc/nginx/ssl/ec.crt; ssl_certificate_key /etc/nginx/ssl/ec.key; if ($scheme != "https") { return 301 https://$host$request_uri; } add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; location / { proxy_pass http://127.0.0.1:55555; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_cache my_cache; proxy_cache_valid 200 302 60m; proxy_cache_valid 404 1m; add_header X-Frame-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; } } ``` systemctl enable nginx --now ### Expected behaviour  web -> https://ip:55552 OK android -> https://ip:55552 OK ### Actual behaviour  web -> https://ip:55552 OK It's slow to load android -> https://ip:55552 Popup dialog 'trust anchor for certification path not found' ### Troubleshooting data

GiteaMirror closed this issue