# Error scanning a QR code on Android

**URL:** <https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526>\
**Category:** Installation Issues\
**Created:** [June 30, 2022, 5:15am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526 "2022-06-30T05:15:51Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![hixr0k](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@hixr0k](https://community.passbolt.com/u/hixr0k)\
**Post date:** [June 30, 2022, 5:15am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/1 "2022-06-30T05:15:51Z")

</div>

Hello.  
After installing Passbolt using docker-compose, there was a problem when scanning a QR code.  
When scanning, an error pops up: “There was an error during transfer update”, below app logs from phone:

> **Logs from Android**
>
> Device: Xiaomi Mi 9T Pro  
> Android 11 (30)  
> Passbolt 1.7.1-9
> 
> 00:35:11 javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:362)  
> at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1134)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1089)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:876)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:747)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:712)  
> at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:849)  
> at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.access$100(ConscryptEngineSocket.java:722)  
> at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:238)  
> at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:217)  
> at okhttp3.internal.connection.RealConnection.connectTls(SourceFile:367)  
> at okhttp3.internal.connection.RealConnection.establishProtocol(SourceFile:325)  
> at okhttp3.internal.connection.RealConnection.connect(SourceFile:197)  
> at okhttp3.internal.connection.ExchangeFinder.findConnection(SourceFile:249)  
> at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(SourceFile:108)  
> at okhttp3.internal.connection.ExchangeFinder.find(SourceFile:76)  
> at okhttp3.internal.connection.RealCall.initExchange$okhttp(SourceFile:245)  
> at okhttp3.internal.connection.ConnectInterceptor.intercept(SourceFile:32)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.cache.CacheInterceptor.intercept(SourceFile:96)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.http.BridgeInterceptor.intercept(SourceFile:83)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(SourceFile:76)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.CookiesInterceptor$AddCookiesInterceptor.intercept(SourceFile:57)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.CookiesInterceptor$ReceivedCookiesInterceptor.intercept(SourceFile:38)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.AuthInterceptor.intercept(SourceFile:22)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.ChangeableBaseUrlInterceptor.intercept(SourceFile:40)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(SourceFile:197)  
> at okhttp3.internal.connection.RealCall$AsyncCall.run(SourceFile:502)  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)  
> at java.lang.Thread.run(Thread.java:923)  
> Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:677)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:554)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:510)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:428)  
> at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:356)  
> at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)  
> at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:90)  
> at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:161)  
> at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:250)  
> at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1644)  
> at com.android.org.conscrypt.NativeCrypto.ENGINE\_SSL\_read\_direct(Native Method)  
> at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:568)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1095)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1079)  
> … 35 more  
> Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> … 49 more
> 
> javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:362)  
> at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1134)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1089)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:876)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:747)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:712)  
> at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:849)  
> at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.access$100(ConscryptEngineSocket.java:722)  
> at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:238)  
> at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:217)  
> at okhttp3.internal.connection.RealConnection.connectTls(SourceFile:367)  
> at okhttp3.internal.connection.RealConnection.establishProtocol(SourceFile:325)  
> at okhttp3.internal.connection.RealConnection.connect(SourceFile:197)  
> at okhttp3.internal.connection.ExchangeFinder.findConnection(SourceFile:249)  
> at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(SourceFile:108)  
> at okhttp3.internal.connection.ExchangeFinder.find(SourceFile:76)  
> at okhttp3.internal.connection.RealCall.initExchange$okhttp(SourceFile:245)  
> at okhttp3.internal.connection.ConnectInterceptor.intercept(SourceFile:32)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.cache.CacheInterceptor.intercept(SourceFile:96)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.http.BridgeInterceptor.intercept(SourceFile:83)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(SourceFile:76)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.CookiesInterceptor$AddCookiesInterceptor.intercept(SourceFile:57)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.CookiesInterceptor$ReceivedCookiesInterceptor.intercept(SourceFile:38)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.AuthInterceptor.intercept(SourceFile:22)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.ChangeableBaseUrlInterceptor.intercept(SourceFile:40)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(SourceFile:197)  
> at okhttp3.internal.connection.RealCall$AsyncCall.run(SourceFile:502)  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)  
> at java.lang.Thread.run(Thread.java:923)  
> Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:677)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:554)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:510)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:428)  
> at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:356)  
> at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)  
> at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:90)  
> at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:161)  
> at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:250)  
> at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1644)  
> at com.android.org.conscrypt.NativeCrypto.ENGINE\_SSL\_read\_direct(Native Method)  
> at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:568)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1095)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1079)  
> … 35 more  
> Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> … 49 more  
> 00:35:11 There was an error during transfer update  
> javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:362)  
> at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1134)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1089)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:876)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:747)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:712)  
> at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:849)  
> at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.access$100(ConscryptEngineSocket.java:722)  
> at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:238)  
> at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:217)  
> at okhttp3.internal.connection.RealConnection.connectTls(SourceFile:367)  
> at okhttp3.internal.connection.RealConnection.establishProtocol(SourceFile:325)  
> at okhttp3.internal.connection.RealConnection.connect(SourceFile:197)  
> at okhttp3.internal.connection.ExchangeFinder.findConnection(SourceFile:249)  
> at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(SourceFile:108)  
> at okhttp3.internal.connection.ExchangeFinder.find(SourceFile:76)  
> at okhttp3.internal.connection.RealCall.initExchange$okhttp(SourceFile:245)  
> at okhttp3.internal.connection.ConnectInterceptor.intercept(SourceFile:32)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.cache.CacheInterceptor.intercept(SourceFile:96)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.http.BridgeInterceptor.intercept(SourceFile:83)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(SourceFile:76)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.CookiesInterceptor$AddCookiesInterceptor.intercept(SourceFile:57)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.CookiesInterceptor$ReceivedCookiesInterceptor.intercept(SourceFile:38)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.AuthInterceptor.intercept(SourceFile:22)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.ChangeableBaseUrlInterceptor.intercept(SourceFile:40)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(SourceFile:197)  
> at okhttp3.internal.connection.RealCall$AsyncCall.run(SourceFile:502)  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)  
> at java.lang.Thread.run(Thread.java:923)  
> Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:677)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:554)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:510)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:428)  
> at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:356)  
> at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)  
> at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:90)  
> at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:161)  
> at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:250)  
> at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1644)  
> at com.android.org.conscrypt.NativeCrypto.ENGINE\_SSL\_read\_direct(Native Method)  
> at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:568)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1095)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1079)  
> … 35 more  
> Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> … 49 more
> 
> javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:362)  
> at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1134)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1089)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:876)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:747)  
> at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:712)  
> at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:849)  
> at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.access$100(ConscryptEngineSocket.java:722)  
> at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:238)  
> at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:217)  
> at okhttp3.internal.connection.RealConnection.connectTls(SourceFile:367)  
> at okhttp3.internal.connection.RealConnection.establishProtocol(SourceFile:325)  
> at okhttp3.internal.connection.RealConnection.connect(SourceFile:197)  
> at okhttp3.internal.connection.ExchangeFinder.findConnection(SourceFile:249)  
> at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(SourceFile:108)  
> at okhttp3.internal.connection.ExchangeFinder.find(SourceFile:76)  
> at okhttp3.internal.connection.RealCall.initExchange$okhttp(SourceFile:245)  
> at okhttp3.internal.connection.ConnectInterceptor.intercept(SourceFile:32)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.cache.CacheInterceptor.intercept(SourceFile:96)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.http.BridgeInterceptor.intercept(SourceFile:83)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(SourceFile:76)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.CookiesInterceptor$AddCookiesInterceptor.intercept(SourceFile:57)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.CookiesInterceptor$ReceivedCookiesInterceptor.intercept(SourceFile:38)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.AuthInterceptor.intercept(SourceFile:22)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at com.passbolt.mobile.android.core.networking.interceptor.ChangeableBaseUrlInterceptor.intercept(SourceFile:40)  
> at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:100)  
> at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(SourceFile:197)  
> at okhttp3.internal.connection.RealCall$AsyncCall.run(SourceFile:502)  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)  
> at java.lang.Thread.run(Thread.java:923)  
> Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:677)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:554)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:510)  
> at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:428)  
> at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:356)  
> at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)  
> at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:90)  
> at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:161)  
> at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:250)  
> at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1644)  
> at com.android.org.conscrypt.NativeCrypto.ENGINE\_SSL\_read\_direct(Native Method)  
> at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:568)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1095)  
> at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1079)  
> … 35 more  
> Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.  
> … 49 more

If I understand correctly, this happens because of an incomplete certificate chain. I tried to make a certificate and a key (cert.pem and key.pem) following this instruction [https://help.passbolt.com/faq/hosting/mobile-faq:](https://help.passbolt.com/faq/hosting/mobile-faq:)

```auto
openssl req -x509 \
    -newkey rsa:4096 \
    -days 120 \
    -subj "/C=LU/ST=Luxembourg/L=Esch-Sur-Alzette/O=Passbolt SA/OU=Passbolt IT Team/CN=passbolt.domain.tld/" \
    -nodes \
    -addext "subjectAltName = DNS:passbolt.domain.tld" \
    -keyout key.pem \
    -out cert.pem

```

Next, I fixed the paths to new certificates in the passbolt container, in the nginx /etc/nginx/snippets/passbolt-ssl.conf configuration file:

```auto
## Passbolt provided file to be included from nginx main virtual hosts file.
# It allows to pull common SSL settings from a central place.
#
# Use the nginx include directive to pull this information in.
#
 
  # Managed by Passbolt
  listen [::]:443 ssl http2;
listen 443 ssl http2;
 
  ssl_certificate /etc/ssl/certs/cert.pem;
  ssl_certificate_key /etc/ssl/certs/key.pem;

```

But even after that, when I scan the QR code, I get an error: “There was an error during transfer update” ☹  
The browser on the computer only shows one certificate, not a chain of three certificates.  
Help me please. How to properly configure the system?

---

<div class="post-metadata">

**Author:** ![AnatomicJC](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/anatomicjc/32/962_2.png) [@AnatomicJC](https://community.passbolt.com/u/AnatomicJC)\
**Post date:** [June 30, 2022, 5:23am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/2 "2022-06-30T05:23:58Z")

</div>

Hello @hixr0k 👋 and welcome to passbolt community forum 🧑‍🤝‍🧑

You are almost done 🙂 While using self-signed certificates, you have to import the generated certificate in your Android app.

You can follow instructions from this page: [Passbolt Help | How to import SSL certificate on mobile application](https://help.passbolt.com/faq/hosting/how-to-import-ssl-certificate-on-mobile#import-certificate-on-android)

Let me know if it fixes your issue.

> [@hixr0k](#):
>
> The browser on the computer only shows one certificate, not a chain of three certificates.

There is not always 3 certificates in a full chain of trust for SSL, in case of your self-sign, there is only one.

One another hint, in our `openssl` command example, the certificate is valid for 4 months (`-days 120` parameter.). You can increase it to avoid renewing certificate too often.

Cheers,

---

<div class="post-metadata">

**Author:** ![hixr0k](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@hixr0k](https://community.passbolt.com/u/hixr0k)\
**Post date:** [June 30, 2022, 6:07am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/3 "2022-06-30T06:07:45Z")

</div>

> [@AnatomicJC](#):
>
> You are almost done 🙂 While using self-signed certificates, you have to import the generated certificate in your Android app.

As I understand it, there is no way to import a .pem certificate into android.

I opened the local passbolt website ([https://192.168.1.138](https://192.168.1.138)) and clicked on the padlock icon and opened the certificate. I selected the “Details” tab and clicked the “Copy to File” button, then chose the “DER encoded binary X.509(.CER)” export format and saved the certificate. I was able to import the exported certificate into Android.  
But it didn’t help me ☹  
When scanning the QR, I see the error again: “There was an error during transfer update”.

---

<div class="post-metadata">

**Author:** ![AnatomicJC](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/anatomicjc/32/962_2.png) [@AnatomicJC](https://community.passbolt.com/u/AnatomicJC)\
**Post date:** [June 30, 2022, 6:56am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/4 "2022-06-30T06:56:58Z")

</div>

Hi,

When you generate your certificates with this command:

```auto
openssl req -x509 \
    -newkey rsa:4096 \
    -days 120 \
    -subj "/C=LU/ST=Luxembourg/L=Esch-Sur-Alzette/O=Passbolt SA/OU=Passbolt IT Team/CN=passbolt.domain.tld/" \
    -nodes \
    -addext "subjectAltName = DNS:passbolt.domain.tld" \
    -keyout key.pem \
    -out cert.pem

```

You get 2 files:

- key,pem
- cert,pem

The generated cert.pem file is the certificate you want to be added in Android.

I noticed you are using an IP address instead of a domain name. As written in [our documentation](https://help.passbolt.com/configure/https/ce/debian/manual.html):

> You can use an IP address instead of a domain name for your self-signed certificate. If you do that, replace DNS with IP in subjectAltName.

So in case of an IP address, the correct command is:

```auto
openssl req -x509 \
    -newkey rsa:4096 \
    -days 3650 \
    -subj "/C=LU/ST=Luxembourg/L=Esch-Sur-Alzette/O=Passbolt SA/OU=Passbolt IT Team/CN=192.168.1.138/" \
    -nodes \
    -addext "subjectAltName = IP:192.168.1.138" \
    -keyout key.pem \
    -out cert.pem

```

Best,

---

<div class="post-metadata">

**Author:** ![hixr0k](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@hixr0k](https://community.passbolt.com/u/hixr0k)\
**Post date:** [June 30, 2022, 8:36am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/5 "2022-06-30T08:36:07Z")

</div>

> [@AnatomicJC](#):
>
> So in case of an IP address, the correct command is:
> 
> ```auto
> openssl req -x509 \
> -newkey rsa:4096 \
> -days 3650 \
> -subj "/C=LU/ST=Luxembourg/L=Esch-Sur-Alzette/O=Passbolt SA/OU=Passbolt IT Team/CN=192.168.1.138/" \
> -nodes \
> -addext "subjectAltName = IP:192.168.1.138" \
> -keyout key.pem \
> -out cert.pem
> 
> ```

Yes, I originally did that, I forgot to write

> [@AnatomicJC](#):
>
> The generated cert.pem file is the certificate you want to be added in Android.

If I’m right, then Android doesn’t import .pem certificates

---

<div class="post-metadata">

**Author:** ![AnatomicJC](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/anatomicjc/32/962_2.png) [@AnatomicJC](https://community.passbolt.com/u/AnatomicJC)\
**Post date:** [June 30, 2022, 9:12am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/6 "2022-06-30T09:12:18Z")

</div>

Hi,

I just generated SSL certificates with the command above, I copied the generated cert.pem on my Android phone (MI 9T PRO with Android 12.1) and I have been able to import the certificate.

Here is a video:

> **[Install self-signed certificate for passbolt on Android](https://www.youtube.com/shorts/R7dXjJTwkMM)**
>
> Related to https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/https://help.passbolt.com/faq/hosting/how-to-import-ssl-certificate-on-m...

It doesn’t work for you ?

---

<div class="post-metadata">

**Author:** ![hixr0k](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@hixr0k](https://community.passbolt.com/u/hixr0k)\
**Post date:** [June 30, 2022, 10:33am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/7 "2022-06-30T10:33:36Z")

</div>

> [@AnatomicJC](#):
>
> Here is a video:
> 
> [https://www.youtube.com/shorts/R7dXjJTwkMM](https://www.youtube.com/shorts/R7dXjJTwkMM)

Thank you very much for the video! I finally found this menu section and installed the .pem certificate. When I get home, I will test the application on Android and write the result

---

<div class="post-metadata">

**Author:** ![hixr0k](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@hixr0k](https://community.passbolt.com/u/hixr0k)\
**Post date:** [July 1, 2022, 8:09am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/8 "2022-07-01T08:09:18Z")

</div>

Thank you for the video! After importing the certificate, it was possible to connect the application.

---

<div class="post-metadata">

**Author:** ![AnatomicJC](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/anatomicjc/32/962_2.png) [@AnatomicJC](https://community.passbolt.com/u/AnatomicJC)\
**Post date:** [July 1, 2022, 8:11am UTC](https://community.passbolt.com/t/error-scanning-a-qr-code-on-android/5526/9 "2022-07-01T08:11:28Z")

</div>

Great ! Thank you for your feedback and enjoy your self-hosted instance 😉

Cheers,