# Full Local SelfHosted BW - Android App issue **URL:** \ **Category:** Help\ **Created:** [February 7, 2021, 3:17pm UTC](https://vaultwarden.discourse.group/t/full-local-selfhosted-bw-android-app-issue/582 "2021-02-07T15:17:07Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Barbicane](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Barbicane](https://vaultwarden.discourse.group/u/Barbicane)\ **Post date:** [February 7, 2021, 3:17pm UTC](https://vaultwarden.discourse.group/t/full-local-selfhosted-bw-android-app-issue/582/1 "2021-02-07T15:17:07Z")
Hello everyone, I’m struggling with that issue for 4 days now, i’m asking for someone cleverness to help me … I’ve basically setup a bitwarden docker on a NAS which is not reachable from the Internet (local access only, that’s what I want). I can log on my Bitwarden instance Web UI on all browsers on my computer, it works like a charm. But I can’t figure out how to make the Android app working. Each time I try to connect, i have the _ **“Trust anchor for certification path not found”** _ error. I’ve seeked for a long time about the certificate chain issue, self signed certificate etc… and here is how I generate my stuff (Self signed certificate with own CA) : > **echo “\>\>\>\>\> CA Key”** > openssl genrsa -des3 -out towerrootCA.key 4096 > **echo “\>\>\>\>\> CA Cert”** > openssl req -x509 -new -nodes -key towerrootCA.key -sha256 -extensions v3\_ca -config conf.file -days 365 -out towerrootCA.crt > > **echo “\>\>\>\>\> Server Key”** > openssl genrsa -out tower.key 2048 > **echo “\>\>\>\>\> Server csr”** > openssl req -new -sha256 -key tower.key -subj “/C=FR/ST=FR/O=MyNas/CN=tower” -extensions v3\_req -out tower.csr > > **echo “\>\>\>\>\> Server cert”** > openssl x509 -req -in tower.csr -CA towerrootCA.crt -CAkey towerrootCA.key -CAcreateserial -out tower.crt -extensions v3\_req -days 365 -sha256 -extfile conf.file > > cat tower.crt towerrootCA.crt \> finalcertif.crt With conf.file : > [req] > distinguished\_name = req\_distinguished\_name > x509\_extensions = v3\_req > prompt = no > [req\_distinguished\_name] > C = FR > ST = FR > L = Local > O = MyNas > OU = MyNas > CN = tower > [v3\_ca] > subjectKeyIdentifier=hash > authorityKeyIdentifier=keyid:always,issuer > basicConstraints = critical, CA:TRUE, pathlen:3 > keyUsage = critical, cRLSign, keyCertSign > nsCertType = sslCA, emailCA > [v3\_req] > keyUsage = nonRepudiation, digitalSignature, keyEncipherment > extendedKeyUsage = serverAuth > subjectAltName = [u/alt\_names](https://www.reddit.com/u/alt_names/) > [alt\_names] > DNS.1 = tower > DNS.2 = tower.local > DNS.3 = tower:18443 I access my bitwarden server with [https://tower:18443/bitwarden](https://tower:18443/bitwarden) I’ve imported my towerrootCA.crt on my computer and on my android phone. My Web Browsers trust the finalcertif.crt (both on computers and Android) **but** the bitwarden application keeps showing me the error. Do you have any idea ? Thank you in advance for your help guys, Regards, ---
**Author:** ![jjlin](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jjlin](https://vaultwarden.discourse.group/u/jjlin)\ **Post date:** [February 7, 2021, 9:20pm UTC](https://vaultwarden.discourse.group/t/full-local-selfhosted-bw-android-app-issue/582/2 "2021-02-07T21:20:43Z")
Just a suggestion – life is much easier having real certificates, and I’d suggest you focus your energy on setting that up instead of managing your own CA. An example: > **[dani-garcia/bitwarden\_rs](https://github.com/dani-garcia/bitwarden_rs/wiki/Running-a-private-bitwarden_rs-instance-with-Let's-Encrypt-certs)** > > Running-a-private-bitwarden\_rs-instance-with-Let's-Encrypt-certs ---
**Author:** ![Barbicane](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Barbicane](https://vaultwarden.discourse.group/u/Barbicane)\ **Post date:** [February 8, 2021, 8:13am UTC](https://vaultwarden.discourse.group/t/full-local-selfhosted-bw-android-app-issue/582/3 "2021-02-08T08:13:03Z")
Hello, Many thanks for you reply ! Considering your method would require me to setup a private DNS or modifying hosts file on all my endpoints to make sure that the duckdns subdomain return the bitwardenrs IP, is that right ? Could it be possible that the Android fails because of the URL I provided in the settings ? I mean “[https://tower:18443/bitwarden](https://tower:18443/bitwarden)” is not just a subdomain, it contains ports and a path, could it be something not handled by the android app ? Thanks ---
**Author:** ![jjlin](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jjlin](https://vaultwarden.discourse.group/u/jjlin)\ **Post date:** [February 8, 2021, 8:43am UTC](https://vaultwarden.discourse.group/t/full-local-selfhosted-bw-android-app-issue/582/4 "2021-02-08T08:43:10Z")
> [@Barbicane](#): > > Considering your method would require me to setup a private DNS or modifying hosts file on all my endpoints to make sure that the duckdns subdomain return the bitwardenrs IP, is that right ? No, DuckDNS provides the DNS server. You don’t need to run any additional server. All you need to do is create an account there and add a DNS entry. Modifying your /etc/hosts files won’t work for this purpose. > [@Barbicane](#): > > Could it be possible that the Android fails because of the URL I provided in the settings ? I mean “[https://tower:18443/bitwarden](https://tower:18443/bitwarden)” is not just a subdomain, it contains ports and a path, could it be something not handled by the android app ? Very unlikely. If it works in your other clients, you probably have an issue with loading your certs, such as not providing the full cert chain. But as I said, getting real certs is much better since you don’t need to worry about whether your certs were generated correctly, or bother with loading them on your various devices. ---
**Author:** ![Barbicane](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Barbicane](https://vaultwarden.discourse.group/u/Barbicane)\ **Post date:** [February 8, 2021, 9:14am UTC](https://vaultwarden.discourse.group/t/full-local-selfhosted-bw-android-app-issue/582/5 "2021-02-08T09:14:36Z")
Ok i got it, so as I understood, caddy would be used as a reverse proxy internally ? ---
**Author:** ![Barbicane](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Barbicane](https://vaultwarden.discourse.group/u/Barbicane)\ **Post date:** [February 8, 2021, 7:09pm UTC](https://vaultwarden.discourse.group/t/full-local-selfhosted-bw-android-app-issue/582/6 "2021-02-08T19:09:15Z")
Ok, I finally got that working with your DNS validation method. Thanks a lot for having put me on the right way man. All is working with : - DuckDNS subdomain - SWAG reverse proxy with DNS validation ([SWAG setup - LinuxServer.io](https://docs.linuxserver.io/general/swag#create-container-via-duckdns-validation-with-a-wildcard-cert)) - My Nextcloud and Bitwarden containers work fine with the generated certificate. All is ok on android app 🙂