Android 10 Ajax https calls not working in release builds, works in debug builds

Bug Report

Problem

Android 10 Ajax https calls not working in Release builds, works in debug builds, including on physical device. Only fails once the app is packaged as release bundle. This only affects ANDROID, there is no issue on iOS.

What does actually happen?

readyState : 0 Ajax error

Information

All calls are made in HTTPS. Everything works perfectly in DEBUG including on physical device. HTTPS calls fail (readyState : 0) in RELEASE builds (bundle) for no apparent reason. Obviously not a CORS/SSL issue since everything works perfectly in debug (.apk) Tested with a debug bundle, extracted to .apks via bundletools, works perfectly… Tested with standard debug APK, works perfectly.

Tested with

<access origin="*" />    
<allow-navigation href="*" />
<preference name="AndroidXEnabled" value="true" />
<preference name="AndroidInsecureFileModeEnabled" value="true" />
<preference name="android-minSdkVersion" value="23" />
<preference name="android-targetSdkVersion" value="30" />
<edit-config file="app/src/main/AndroidManifest.xml" mode="merge" target="/manifest/application" xmlns:android="http://schemas.android.com/apk/res/android">
            <application android:networkSecurityConfig="@xml/network_security_config" />
</edit-config>
<resource-file src="res/xml/network_security_config.xml" target="app/src/main/res/xml/network_security_config.xml" />

this has no impact whatsoever (res/xml/network_security_config.xml)

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />  
        </trust-anchors>
    </base-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">api.domain.com</domain>
    </domain-config>
</network-security-config>

Environment, Platform, Device

Windows 10 x64 Tested on Android 6.0.1

Version information

Cordova Android 10.1.1 Cordova 10.0.0

Checklist

• I searched for existing GitHub issues
• I updated all Cordova tooling to most recent version
• I included all the necessary information above

[globules-io]

Thanks @breautek I’m using Win-Acme here since we’re on Windows Server. I’m not sure I can do much about that… Which is fine in a way, it’s time to drop support to old phones…

[globules-io]

I will answer my own question, it might save someone A LOT of time. The issue is that I’m using let’s encrypt SSL certificates and I had been testing on Android 6.1.0. Following this post I just noticed that Let’s Encrypt SSL certificates will not work anymore on Android < 7.1.1