title: Verifying server Verisign certificates throws Not trusted server certificate exception
body: <p>I have a problem verifying Verisign certificate when trying to connect with HttpsURLConnection to our backend.</p>
  
  <p>Current certification chain:
  <code>$openssl s_client -connect host:443</code></p>
  
  <pre><code>0 s:/C=AT/ST=xxx/L=xxx/O=xxx/CN=host
     i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server CA - G3
  
  1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server CA - G3
     i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Auth
  ority - G5
  
  2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Auth
  ority - G5
     i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
  
  3 s:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
     i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
  </code></pre>
  
  <p>I'm pretty sure i have downloaded and added all certificates into KeyStore, but i still get exception : "<strong>javax.net.ssl.SSLException: Not trusted server certificate</strong>" and the cause is <code>java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: TrustAnchor found but certificate validation failed.</code></p>
  
  <p>My code for obtaining the connection:</p>
  
  <pre><code>String keyStoreType = KeyStore.getDefaultType();
  KeyStore keyStore = KeyStore.getInstance(keyStoreType);
  keyStore.load(null, null);
  keyStore.setCertificateEntry("verisign_0", getVerisign0());
  keyStore.setCertificateEntry("verisign_1", getVerisign1());
  keyStore.setCertificateEntry("verisign_2", getVerisign2());
  keyStore.setCertificateEntry("verisign_3", getVerisign3());
  
  String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
  TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
  tmf.init(keyStore);
  
  SSLContext context = SSLContext.getInstance("TLS");
  context.init(null, tmf.getTrustManagers(), null);
  
  HttpsURLConnection urlConnection = (HttpsURLConnection) url.openConnection();
  urlConnection.setSSLSocketFactory(context.getSocketFactory());
  return urlConnection;
  </code></pre>
  
  <p>issue is happening, when <code>connection.connect()</code> is called. All getVerisign() methods returns correct certificates. Is there a step I have forgotten? Maybe a special order in which the certificates should be added?</p>
  
  <p>Just to clarify, I have used exactly this technique with swisssign certificates and it worked. I'm facing this issue because some of Android 2.1, 2.2 devices does not have some root certificates. Thanks in advance.</p>
  
  <p>StackTrace:</p>
  
  <pre><code>[0] = {java.lang.StackTraceElement@830078967208}"org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:168)"
  [1] = {java.lang.StackTraceElement@830078967584}"org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:366)"
  [2] = {java.lang.StackTraceElement@830078967960}"org.apache.harmony.luni.internal.net.www.protocol.http.HttpConnection.getSecureSocket(HttpConnection.java:168)"
  [3] = {java.lang.StackTraceElement@830078968368}"org.apache.harmony.luni.internal.net.www.protocol.https.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:399)"
  [4] = {java.lang.StackTraceElement@830078968816}"org.apache.harmony.luni.internal.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:147)"
  </code></pre>