How do I import a user CA for the Email app properly? For my own setup I use a personal CA: "Gert van Dijk CA". I'm using this for HTTPS and VPN successfully by importing the CA certificate into the Android keystore. I'm having trouble getting the Email app recognize this. Here are some notes about the current setup:


The custom CA is listed perfectly fine in Settings -> Security -> Trusted Credentials -> User.
Chrome and "OpenVPN for Android" are working with this custom CA. I can see a green location bar when connecting to https://mail.mydomain.tld.


This all looks good, until I come to setting up my Exchange mail. It simply won't connect to mail.mydomain.tld with the error "Couldn't open connection to server". However, when I change "Security Type: SSL/TLS" to "SSL/TLS (Accept all certificates)" it will sync my mail just fine! This makes me believe the stock Email app isn't taking the user credentials in the key store into account. Why?

Logcat shows me this line when receiving the connection error:

I/Exchange(10278): IOException while sending request: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.


To verify I've set up my Exchange server correctly, I navigated to https://mail.mydomain.tld/Microsoft-Server-ActiveSync and the location bar is perfectly green!

How can I make the Email app take the user trusted credentials into account here? I don't want to trust all possible certificates for security reasons.

Android versions: 4.4 (Nexus 5), 4.3 (Nexus 7 2013).
Ah well. It appears that the Stock Email app doesn't do SNI. This means that in the initial connection to the server it was presented with another certificate it should discard (but didn't). It seems to me that this is a feature request for the Email app, as other apps do implement SNI.

Changing the Apache SSL configuration to use SNI with an initial certificate signed with the "Gert van Dijk CA" still didn't solve it. Logcat then showed:

I/Exchange(12307): IOException while sending request: Cannot verify hostname: mail.mydomain.tld


Setting mail.mydomain.tld as initial certificate solved it. I consider this an ugly work around until this has been fixed in the Email app.