fix(android): Trust bundled ISRG Root X1 on API 25 and lower

[sentry-junior]

📜 Description

On Android API 25 and lower, the SDK now sets SentryOptions.sslSocketFactory to a new SentryRootCaSslSocketFactory. That factory trusts the system CAs plus a bundled ISRG Root X1 (Let's Encrypt), which is listed on docs.sentry.io/security-legal-pii/security/ssl.

How it works:

• ISRG Root X1 is bundled as a PEM constant in SentryRootCertificates. A unit test checks its SHA-256 fingerprint against the docs page.
• The system-trusted issuers and the bundled root go into a single KeyStore, which is passed to the platform's default TrustManagerFactory. Chain validation is still done by the platform. There is no custom X509TrustManager.
• options.getSslSocketFactory() is only read by HttpConnection, so the change only applies to the SDK's own AsyncHttpTransport uploads. Other connections in the app keep using the platform defaults. No network security config is involved.
• The SSLContext is built lazily on first use, on the transport thread. If building it fails, we log an error and fall back to the default factory.
• If the user already set a custom sslSocketFactory, it is kept.
• All new classes are package-private, so there are no public API changes.

💡 Motivation and Context

Sentry is moving its TLS certificates from DigiCert to Let's Encrypt and Google Trust Services (announcement). Here is which roots each Android version ships, based on the AOSP CA store:

• ISRG Root X1 was only added in Android 7.1 (API 25). Let's Encrypt's default chains (RSA and ECDSA) all end at X1, so API 21–24 can't validate them without this change. The factory also applies on API 25 to cover vendor builds that lack the root.
• GTS: Google's default chain includes GTS Root R1 cross-signed by GlobalSign Root CA, which Android 5+ already trusts. That cross-sign expires on 2028-01-28, after which API ≤28 will need the GTS roots. This is left for a follow-up and marked with a TODO(2028-01-28) in SentryRootCertificates.
• DigiCert Global Root CA and G2 are already in every supported API level.
• ISRG Root X2 isn't needed, because Sentry will serve Let's Encrypt's default chain, which ends at X1.

Known limitation: this only helps apps that update to an SDK version containing this fix.

💚 How did you test it?

Unit tests:

• SentryRootCaSslSocketFactoryTest: checks the bundled root's fingerprint, that the merged trust store keeps every system-trusted CA, and that the delegate is created lazily and only once.
• AndroidOptionsInitializerTest: checks that the factory is set on API 25, not set on API 26, and that a user-provided factory is kept.

This hasn't been verified on a real API 21–25 device or emulator against a Let's Encrypt endpoint yet.

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

• Do a manual check on an API 21–25 emulator against an ISRG-signed endpoint.
• Before 2028-01-28, revisit bundling the GTS roots for API ≤28 (see the TODO in SentryRootCertificates).

via roman.

--

View Junior Session [Sentry]

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.59.0 (1)	release

⚙️ sentry-android Build Distribution Settings

[runningcode]

gave it a quick look while it is still in draft mode. feel free to re-ask for a review once it is out of draft