@spaghetticode that's helpful, thanks for taking the time to respond! To add some more context, the app clones a Git repository from a user provided URL and performs sync operations every so often. An issue was filed some time ago (github.com/android-password-st) requesting the ability to clone the repository from a domain being served with a self-signed certificate, but I wasn't fully aware of the implications of allowing that so I've held off.