Android must control the available root certificates, as users can choose to revoke certificates on their Android devices. Hence, Android provides a Java API to verify a Server certificate. As usual, Cronet has a Java layer allowing JNI interactions with related Android system libraries. That Cronet layer is fairly complex:

• AndroidNetworkLibrary.verifyServerCertificates: that's the main method.
• AndroidCertVerifyResult: this is the response to the above method. Requires some JNI invocations from the C++ layer to extirpate the data.
• X509Util: that's where the subtle details reside. There are more JNI invocations in there.

Also, to help with testing, there are two methods dealing with root certificates:

• AndroidNetworkLibrary.addTestRootCertificate
• AndroidNetworkLibrary.clearTestRootCertificates