Which hosts and ports must be allowed for the Pushwoosh Android SDK in a corporate network?

If your app runs on a restricted network (corporate Wi-Fi, MDM-managed devices), allow the following outgoing connections.

Pushwoosh (HTTPS, port 443)

• *.api.pushwoosh.com — the SDK API. Each project uses its own subdomain based on the application code, so allow the wildcard, not a single host.
• tracking.svc-nue.pushwoosh.com — device and event tracking.
• richmedia.pushwoosh.com — In-App and Rich Media content.

Google (required to get a push token)

• fcm.googleapis.com and firebaseinstallations.googleapis.com on port 443.
• Outgoing TCP ports 5228, 5229 and 5230 to Google. Google does not publish fixed hosts for these ports, so allow the ports without IP restrictions.

A blocked host looks like a certificate error

Many corporate filters don't drop a blocked connection. They answer it with their own certificate (a block page). In the app log this shows up as:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found

If you see this error only on one network, check the allowlist first. Typos in the domain name are a common cause.

If the network inspects TLS traffic with its own certificate authority, note that since Android 7.0 apps ignore user-installed certificates. A browser on the same Wi-Fi may work while the app fails. The corporate CA must be installed as a system certificate via your MDM.

Related articles

• What Pushwoosh IP Addresses should I whitelist?
• Why can't the Pushwoosh SDK connect on devices with Android 7.0 or older?