Added in [API level 17](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Summary: [Ctors](https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#pubctors) \| [Methods](https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#pubmethods) \| [Inherited Methods](https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#inhmethods)

# X509TrustManagerExtensions

*** ** * ** ***


`
public


class
X509TrustManagerExtensions
`


`

extends https://developer.android.com/reference/java/lang/Object


`

`


`

|---|---|
| [java.lang.Object](https://developer.android.com/reference/java/lang/Object) ||
| ↳ | android.net.http.X509TrustManagerExtensions |

<br />

*** ** * ** ***

X509TrustManager wrapper exposing Android-added features.


The checkServerTrusted methods allow callers to provide some additional
context for the verification. This is particularly useful when an SSLEngine
or SSLSocket is not available.

<br />

## Summary

| ### Public constructors ||
|---|---|
| ` https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#X509TrustManagerExtensions(javax.net.ssl.X509TrustManager)(https://developer.android.com/reference/javax/net/ssl/X509TrustManager tm) ` Constructs a new X509TrustManagerExtensions wrapper. |

| ### Public methods ||
|---|---|
| ` https://developer.android.com/reference/java/util/List<https://developer.android.com/reference/java/security/cert/X509Certificate>` | ` https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#checkServerTrusted(java.security.cert.X509Certificate[],%20java.lang.String,%20java.lang.String)(https://developer.android.com/reference/java/security/cert/X509Certificate chain, https://developer.android.com/reference/java/lang/String authType, https://developer.android.com/reference/java/lang/String host) ` Verifies the given certificate chain. |
| ` https://developer.android.com/reference/java/util/List<https://developer.android.com/reference/java/security/cert/X509Certificate>` | ` https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#checkServerTrusted(java.security.cert.X509Certificate[],%20byte[],%20byte[],%20java.lang.String,%20java.lang.String)(https://developer.android.com/reference/java/security/cert/X509Certificate chain, byte[] ocspData, byte[] tlsSctData, https://developer.android.com/reference/java/lang/String authType, https://developer.android.com/reference/java/lang/String host) ` Verifies the given certificate chain. |
| ` boolean` | ` https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#isSameTrustConfiguration(java.lang.String,%20java.lang.String)(https://developer.android.com/reference/java/lang/String hostname1, https://developer.android.com/reference/java/lang/String hostname2) ` Returns `true` if the TrustManager uses the same trust configuration for the provided hostnames. |
| ` boolean` | ` https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#isUserAddedCertificate(java.security.cert.X509Certificate)(https://developer.android.com/reference/java/security/cert/X509Certificate cert) ` Checks whether a CA certificate is added by an user. |
| ` void` | ` https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions#setNetworkSecurityPolicy(android.security.NetworkSecurityPolicy)(https://developer.android.com/reference/android/security/NetworkSecurityPolicy policy) ` Sets the `https://developer.android.com/reference/android/security/NetworkSecurityPolicy` to be used by this TrustManager. |

### Inherited methods

From class `

https://developer.android.com/reference/java/lang/Object

` `


https://developer.android.com/reference/java/lang/Object` `
https://developer.android.com/reference/java/lang/Object#clone()()
`

Creates and returns a copy of this object.


`


boolean` `
https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object)(https://developer.android.com/reference/java/lang/Object obj)
`

Indicates whether some other object is "equal to" this one.


`


void` `
https://developer.android.com/reference/java/lang/Object#finalize()()
`

Called by the garbage collector on an object when garbage collection
determines that there are no more references to the object.


`


final

https://developer.android.com/reference/java/lang/Class<?>` `
https://developer.android.com/reference/java/lang/Object#getClass()()
`

Returns the runtime class of this `Object`.


`


int` `
https://developer.android.com/reference/java/lang/Object#hashCode()()
`

Returns a hash code value for the object.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#notify()()
`

Wakes up a single thread that is waiting on this object's
monitor.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#notifyAll()()
`

Wakes up all threads that are waiting on this object's monitor.


`


https://developer.android.com/reference/java/lang/String` `
https://developer.android.com/reference/java/lang/Object#toString()()
`

Returns a string representation of the object.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#wait(long,%20int)(long timeoutMillis, int nanos)
`

Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*, or until a
certain amount of real time has elapsed.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#wait(long)(long timeoutMillis)
`

Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*, or until a
certain amount of real time has elapsed.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#wait()()
`

Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*.


## Public constructors

### X509TrustManagerExtensions

Added in [API level 17](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public X509TrustManagerExtensions (X509TrustManager tm)
```

Constructs a new X509TrustManagerExtensions wrapper.

<br />

| Parameters ||
|---|---|
| `tm` | `X509TrustManager`: A `https://developer.android.com/reference/javax/net/ssl/X509TrustManager` as returned by TrustManagerFactory.getInstance(); <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/lang/IllegalArgumentException` | If tm is an unsupported TrustManager type. |

## Public methods

### checkServerTrusted

Added in [API level 17](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public List<X509Certificate> checkServerTrusted (X509Certificate[] chain, 
                String authType, 
                String host)
```

Verifies the given certificate chain.

See `https://developer.android.com/reference/javax/net/ssl/X509TrustManager#checkServerTrusted(java.security.cert.X509Certificate[],%20java.lang.String)` for a
description of the chain and authType parameters. The final parameter, host, should be the
hostname of the server.

<br />

<br />

| Parameters ||
|---|---|
| `chain` | `X509Certificate` <br /> |
| `authType` | `String` <br /> |
| `host` | `String` <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/List<https://developer.android.com/reference/java/security/cert/X509Certificate>` | the properly ordered chain used for verification as a list of X509Certificates. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/security/cert/CertificateException` | if the chain does not verify correctly. |

### checkServerTrusted

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public List<X509Certificate> checkServerTrusted (X509Certificate[] chain, 
                byte[] ocspData, 
                byte[] tlsSctData, 
                String authType, 
                String host)
```

Verifies the given certificate chain.

See `https://developer.android.com/reference/javax/net/ssl/X509TrustManager#checkServerTrusted(java.security.cert.X509Certificate[],%20java.lang.String)` for a
description of the chain and authType parameters. The final parameter, host, should be the
hostname of the server.

ocspData and tlsSctData may be provided to verify any Signed Certificate Timestamp (SCT)
attached to the connection. These are ASN.1 octet strings (SignedCertificateTimestampList) as
described in RFC 6962, Section 3.3. Note that SCTs embedded in the certificate chain will
automatically be processed.

<br />

| Parameters ||
|---|---|
| `chain` | `X509Certificate`: This value cannot be `null`. <br /> |
| `ocspData` | `byte`: This value may be `null`. <br /> |
| `tlsSctData` | `byte`: This value may be `null`. <br /> |
| `authType` | `String`: This value cannot be `null`. <br /> |
| `host` | `String`: This value cannot be `null`. <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/List<https://developer.android.com/reference/java/security/cert/X509Certificate>` | the properly ordered chain used for verification as a list of X509Certificates. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/lang/IllegalArgumentException` | if the TrustManager is not compatible. |
| `https://developer.android.com/reference/java/security/cert/CertificateException` | if the chain does not verify correctly. |

### isSameTrustConfiguration

Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isSameTrustConfiguration (String hostname1, 
                String hostname2)
```

Returns `true` if the TrustManager uses the same trust configuration for the provided
hostnames.

<br />

| Parameters ||
|---|---|
| `hostname1` | `String` <br /> |
| `hostname2` | `String` <br /> |

| Returns ||
|---|---|
| `boolean` | <br /> |

### isUserAddedCertificate

Added in [API level 21](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isUserAddedCertificate (X509Certificate cert)
```

Checks whether a CA certificate is added by an user.

Since `https://developer.android.com/reference/javax/net/ssl/X509TrustManager#checkServerTrusted(java.security.cert.X509Certificate[],%20java.lang.String)` may allow its parameter `chain` to
chain up to user-added CA certificates, this method can be used to perform additional
policies for user-added CA certificates.

<br />

| Parameters ||
|---|---|
| `cert` | `X509Certificate` <br /> |

| Returns ||
|---|---|
| `boolean` | `true` to indicate that the certificate authority exists in the user added certificate store, `false` otherwise. <br /> |

### setNetworkSecurityPolicy

Added in [version 37.2](https://developer.android.com/topic/libraries/support-library/revisions)

```
public void setNetworkSecurityPolicy (NetworkSecurityPolicy policy)
```

Sets the `https://developer.android.com/reference/android/security/NetworkSecurityPolicy` to be used by this TrustManager.

This method allows an application to associate a specific security policy with this `https://developer.android.com/reference/javax/net/ssl/X509TrustManager` instance. When a policy is set, it overrides the default process-wide
policy returned by `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#getInstance()` for all certificate
verifications performed by this TrustManager.

The TrustManager will query the provided policy for security decisions, including:

- Whether cleartext traffic is permitted for a specific hostname.
- Whether Certificate Transparency (CT) verification is required for a hostname.
- The domain encryption mode (e.g., Encrypted Client Hello) to be used.

By using a custom `https://developer.android.com/reference/android/security/NetworkSecurityPolicy`, applications can programmatically define
granular security constraints that differ from the global application configuration. This is
useful for specialized network stacks or for enforcing stricter security on specific
sensitive connections.

<br />

| Parameters ||
|---|---|
| `policy` | `NetworkSecurityPolicy`: the `https://developer.android.com/reference/android/security/NetworkSecurityPolicy` to associate with this TrustManager. Must not be `null`. <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/NetworkSecurityPolicy`
- `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#getInstance()`