Certificate Pinning doesn't work for me

[HFPasfho]

I have a server in local network that uses self signed SSL certificate. My test shortcut works great if I accept any certificate in advanced technical settings but if I uncheck this option I get error
java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
Adding my certificate fingerprint in certificate pinning in settings doesn't help and I get the same error.
I tried to generate certificate with localhost or server IP address in CN and SAN and enter it in hostname pattern field but without luck. I'm clearly doing something wrong and I would appreciate some help.

[HFPasfho]

Can someone confirm that this feature actually works? I don't know if I'm loosing time because of my lack of knowledge of a software bug.

[HFPasfho]

Well, I thought this feature just checks if certificate fingerprint match this in certificate pinning tab, a simple string comparison. That's unfortunate because custom system level CAs seems overkill for my basic needs

[Waboodoo]

Yeah, unfortunately. There is one thing you could try, though I do not recommend this if you actually want to achieve proper security:
If you enable the "Accept any certificate" option, it will disable the normal verification of the certificates. However, if you then in addition add certificate pinning for your specific certificate, you essentially end up with a very primitive form of certificate checking, meaning it won't do any hostname verification or certificate chain verification, but only check whether the certificate is the exact one you expect. So by combining these 2 features, you sort of get the feature you want.

[HFPasfho]

In situation you described I get an error

Certificate pinning failure!
Peer certificate chain:
Pinned certificates for 123.123.123.123: A1:B2:C3...

The peer certificate chain is empty so something is not right.

Also, could you explain why what I want to achieve isn't a "proper security"? I know that certificate should be validated by trusted CA, but you can't get a certificate for local IP address and creating my own CA to "authenticate" my own self signed certificate is in my understanding only adding an extra step without adding anything to security. Self signed certificate with fingerprint checking security is based on unlikeness of generating another certificate with same fingerprint and securing certificate on server against theft. I don't see how adding custom CA to this would help increasing security. If I'm horribly wrong please correct me I would be quite happy to learn something new to me.

[Waboodoo]

could you explain why what I want to achieve isn't a "proper security"

I'm not saying what you want to achieve isn't proper. Having a self-signed certificate is a valid usecase, if done properly. My concern is with the fact that the app currently has no support for this, so whatever workaround you use might be insecure for one reason or another. I'm no expert on this topic, so I'm also not confident in making any kinds of recommendations or detailed explanations as they might simply be wrong, or there might be flaws in the way I implemented them. I would have to look more deeply into this topic, and then maybe I could implement better support for it. So far it's simply never come up, which is why there's no feature for it.

[HFPasfho]

Ok thank you for explanations and your time. I decided to create a feature request related to the topis of this discussion. It would be great if this was implemented someday.