Android Studio: Server's certificate is not trusted

Question

Is it safe to ignore this warning? It shows up when I create a new project in Android Studio:

Server\'s certificate is not trusted

Certificate details

Issued T         


        

Answer 1

It is not safe to ignore that warning. Someone could be attempting a man-in-the-middle attack with a fake certificate in order to install malicious software on your computer through the update process. This probably isn't happening but it's always better to do things correctly when it comes to security.

You should instead add root certificates you trust to the Android Studio keystore. The location and default password of the keystore should be listed at the bottom of that warning. For example, mine is at ~/Library/Caches/AndroidStudio/tasks/cacerts. Next you'll want to find the root certificate in the chain the server is presenting. Unfortunately the warning doesn't list the whole chain so it takes a little work to find it. The Google Internet Authority G2 certificate is the same one that is used to sign the certificates for google's sites. You can view the chain in Chrome by going to google.com, clicking on the green lock, then "Certificate Information" in the connection tab. At this point you can verify that the hashes in the warning match the hashes for the real G2 certificate. You'll also see that the root certificate is named Equifax Secure Certificate Authority. You can download it from https://www.geotrust.com/resources/root-certificates/. Next you'll need to add it to the keystore:

keytool -import -alias equifaxca \
-file Equifax_Secure_Certificate_Authority.pem -keystore cacerts

Finally, restart Android Studio. That warning should not appear again until August 22, 2018 unless someone is actually presenting a fake certificate.