An LSPosed / Xposed module that stops the false "untrusted network certificate" full-screen error in the official OpenAI ChatGPT Android app when a working proxy or VPN is in use.
- Target app:
com.openai.chatgpt - Verified against: ChatGPT
1.2026.237(versionCode2623716)
When you route ChatGPT through a proxy, the app sometimes raises:
网络配置问题 — 为保障你的安全，当此网络提供非预期的 SSL 证书时，ChatGPT 无法建立连接……
even when the proxy itself is perfectly fine. Internally, ChatGPT walks the Throwable cause chain of any network failure (up to 50 levels) and — on any SSLHandshakeException or CertificateException — flips its certificate-status StateFlow to a "bad certificate" state. The UI then switches to a blocking full-screen error. That classification is far too broad: a transient / incidental TLS hiccup through a healthy proxy gets promoted to a scary security warning, and the whole chat UI is taken hostage.
Does:
- Intercepts the certificate-status flow write at the single choke point (
x960.m(Object, Object)on the flow held by theNetworkCertificateStatusService), and drops only the bad-certificate state (f6w). The flow stays on the normal state, so the full-screen error never appears.
Does NOT:
- Disable SSL/TLS verification, certificate pinning, hostname verification, or VPN detection.
- Short-circuit the app's network-error mapper — timeouts, disconnects, and real request failures are still handled normally. If a proxy genuinely MITMs TLS, you'll see a plain network error instead of a misleading security warning; your login token and chat traffic remain TLS-protected.
This keeps the fix minimal: one state write suppressed, everything else untouched.
- Rooted device with LSPosed (or a compatible Xposed framework)
- The official ChatGPT app installed (
com.openai.chatgpt)
- Install
NetCertFix-vX.apk(from a release, or built from source). - Enable the module in LSPosed. The scope is pre-filled with
com.openai.chatgpt— make sure it's checked. - Force-stop ChatGPT (or reboot), then start it with your proxy on.
The module logs its activity via XposedBridge.log — look for lines prefixed with NetCertFix:. On success you'll see:
NetCertFix: ready. service=wcy, badState=<pin-to-initial>
NetCertFix: blocked untrusted-network-certificate state write
The hook targets obfuscated names that change with every app release:
- Adaptive path — DexKit runs first, locating the service by the string anchor
NetworkCertificateStatusService, and then pins the certificate flow to its initial (normal) value. This avoids treating a reused short R8 name as the old target class. - Verified fallback — if DexKit is unavailable, structurally validated, version-paired names are available for
1.2026.237(wcy/tcy) and1.2026.230(i6w/f6w). The DexKit native library is bundled for all four ABIs.
If neither path resolves, the module stays inactive and logs a clear message instead of crashing.
Requires a JDK (11+), an Android SDK (platform + build-tools), and curl.
./build.sh # downloads deps on first run, outputs out/NetCertFix-vX.apkbuild.sh uses the Android SDK at $ANDROID_HOME (falls back to the default location), invokes aapt2, javac, d8, zipalign and apksigner, and signs the result with a local debug keystore (debug.keystore, auto-generated). Re-run the same keystore to produce signature-compatible updates.
Releases are built automatically: pushing a v* tag triggers the GitHub Actions workflow (.github/workflows/release.yml), which builds the APK and publishes it to a GitHub Release.
MIT — see LICENSE.
Third-party components bundled at build time are listed in THIRD-PARTY-NOTICES.md.
This project is not affiliated with, endorsed by, or sponsored by OpenAI. "ChatGPT" and "OpenAI" are trademarks of OpenAI; they are used here nominatively only to describe the target app this module is designed for. The module does not modify, redistribute, or decrypt the target app's code.