title: How to trust SSL certificates with cross-signed root expired on android <= 5
body: <p>I work for a company that uses a Comodo/Sectigo SSL certificate. But suddenly our app started throwing this error when sending POST to the server, in versions with android 4 and 5, with Okhttp client. </p>
  
  <pre><code>HTTP FAILED: javax.net.ssl.SSLHandshakeException: com.android.org.bouncycastle.jce.exception.ExtCertPathValidatorException: Could not validate certificate: Certificate expired at Sat May 30 05:48:38 CDT 2020 (compared to Mon Jun 08 23:13:02 CDT 2020)
  </code></pre>
  
  <p>I tried many StackOverflow solutions, without success. Then I found on the Comodo blog this cross-sign certificates <a href="https://support.comodoca.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020?retURL=%2Fapex%2FCom_KnowledgeWeb2Casepage&amp;popup=false" rel="nofollow noreferrer">warning</a></p>
  
  <blockquote>
    <p>Sectigo at present offers the ability to cross-sign certificates with
    the AddTrust legacy root to increase support among very old systems
    and devices.  This root is due to expire at the end of May, 2020.  Any
    applications or installations that depend on this cross-signed root
    must be updated by May, 2020 or run the risk of outage or displayed
    error message.</p>
  </blockquote>
  
  <p>I tried a few more things to get my okhttp client to trust the certificate (enabled TLS on Socket, added Modern TLS, TLS Versions and cipher Suites to connection Specs in okhttp builder, adding the cert to the raw resources, also I put a custom SslSocketFactory to the client) but none of this works, always throws me an error related to certificate validity or a handshake exception.</p>
  
  <p>The only thing that has worked for me is to make an unsafe okhttp, but obviously its use in production is not recommended.</p>
  
  <p>The app works fine in android > 5, but we still have some users on android 5 and even 4 who cannot use the app due to this problem. Is there still any way to achieve android &lt;= 5 trust this expired root?</p>
  
  <p>Thanks for your help</p>