Remote DB connection on Android

BIZ TMS RemoteDB
1

Hello,
I have an FMX RemoteDB App working fine via https,
but after user renewed the server certificate, the same Apk do not connect, with error:

https://myserver.com/tms/, #class:EJNIException #msg:javax.net.ssl.SSLHandshakeException: 
java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

I was thinking to an Android problem in trusting certificates, but
my Apk use also secure websocket connection (wss Esegece - Indy) on same server other port, and keep connecting well after the certificate renewal...
Also a RemoteDB VCL application accessing the same server url, connect fine as usual...

May be something to configure different on fmx RemoteDB ?

BR

2

It still looks like a bad certificate, or a too new certificate that an old Android device doesn't support.

The fact that other apps keep connecting doesn't mean much - it might be a different Android app with different manifest, or it might be that simply the client ignores some issues with the server certificate. RemoteDB users the underlying native HTTPS classes to connect to the server.

Here is a topic from Stack Overflow that has literally dozens of solutions and ways to check for the problem:

3

Thak you Wagner,
most probably a too new certificate that Android 13 doesn't support....
I have read that if the Devece do not have onboard the full chain of certificate
(Root and intermediate) and the Server do not supply the complete chain, this can raise the problem...
Some says to force server to give at client the full chain, and other to load on device or App these root certificates...

BR

4

Of course I have renewd also the certificate link in Tms HttpSys Tool,
but the result is as said.

5

Hi Wagner,
I have no control over server side that refuse to modify the certificate to include the full chain...

Could you help me to include the certificate files in the delphi App ?
or is it possible make RemoteDB bypass the Certificates on Android as can be done with Sparkle on Windows ?

Sorry to bother you, but I am really in troubles with the App offline...

BR

6

Have you tried one of the many proposed solutions in the link I provided to you?
I think you can do that at the Android device level, or the apk level, by adding the trust of chain of the certificate somehow.

7

yes, I added all the 3 files of the certificates chain in the device Android repository;
they are listed correctly, but without any effect...

PhxDEV2_ScreenShot_20250803224056
PhxDEV2_ScreenShot_20250803224056540×1080 52.3 KB

8

And no way to make RemoteDB bypass the Certificates on Android as can be done with Sparkle on Windows ?

9

Is it possible an override in OnSendingRequest event

function THttpClient.Send(Request: THttpRequest): THttpResponse;
begin
  if Assigned(FOnSendingRequest) then
    FOnSendingRequest(Request);
  if Request.AsUri.Scheme = 'local' then
    Result := FInProcEngine.Send(Request)
  else
    Result := FEngine.Send(Request);
  if Assigned(FOnResponseReceived) then
    DoResponseReceived(Request, Result);
end;

as in the example you provided for the bypass in Windows ?

10

Have you tried this solution (from the link I sent you)?

I think this is the more straightforward option.

11

not this one with manifest.
I have added manually the full chain in Android repository, but no change...

I can try this with App manifest, but not clear which Target path must use for the DER file in Delphi project Deployment...

12

I have tryed these remote paths:

  • sectigo_r36.crt → res\raw\
  • network_security_config.xml → res\xml\

and it works !!

Thank you for patience !

1 Like
13

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.