background maps not showing on older android systems.

RasmusLind

as the subject suggests i have a problem on the app i have made with the backgroundmaps not showing on older models. The background maps comes from a group on an agol organisation https://danmarksdata.maps.arcgis.com/home/group.html?sortField=modified&sortOrder=desc&id=1a2896d741ac4fc19da7f1b13aa5f82d#content. i use http calls to the rest api to find the items in the group and then uses: 

Basemap.withItem(basemapitem.results[0]);

to make the Basemap object.

the newest version of android where is fails has been android 13 api 33-ext5.

has any one else experienced something like this and has a solution to this. 

HarishK

Short answer
This is a TLS trust‑store issue on older Android builds. Your basemaps ultimately hit https://services.datafordeler.dk, whose current certificate chain (Sectigo “Public Server Authentication” hierarchy) isn’t in the system trust store on some older devices, so Android rejects the handshake. On newer OS versions the chain is trusted, so everything works. [sectigo.com], [developer....ndroid.com]

The ArcGIS Maps SDK for Flutter surfaces this as a NetworkAuthenticationChallenge. Handle the ServerTrustAuthenticationChallenge and explicitly trust that host at runtime.

---

Why it happens on older Android only

• Android’s certificate trust store is part of the OS and evolves with releases. If a root/intermediate CA isn’t present (or has changed due to industry migrations), TLS handshakes fail even when the server is correctly configured. [developer....ndroid.com]
• Sectigo has been migrating issuance to newer single‑purpose roots (e.g., R46/E46). Devices that haven’t received updated root stores may not recognize these chains until updated or handled in-app. [sectigo.com]

---

App‑level fix: trust the host when challenged

The SDK lets you register a NetworkAuthenticationChallengeHandler. When the device doesn’t trust a server cert, you’ll receive a ServerTrustAuthenticationChallenge; respond with a ServerTrustNetworkCredential to trust just that host and retry the request.

Scope & safety: This trusts only the host you specify and only inside your app (not system‑wide). It’s a standard, supported workflow in the ArcGIS Maps SDK. [developers...arcgis.com]

Code (Flutter / Dart):

import 'dart:async';
import 'package:flutter/material.dart';
import 'package:arcgis_maps/arcgis_maps.dart';

// 1) (Optional) Persist network credentials across launches.
Future<void> initAuthStores() async {
  await ArcGISEnvironment.authenticationManager.setNetworkCredentialStore(
    await NetworkCredentialStore.initPersistentStore(),
  ); // persists in Android Keystore / iOS Keychain
}

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await initAuthStores();
  // Set your API key here...
  runApp(const MyApp());
}

class MyApp extends StatelessWidget {
  const MyApp({super.key});
  @override
  Widget build(BuildContext context) => const MaterialApp(home: MapPage());
}

class MapPage extends StatefulWidget {
  const MapPage({super.key});
  @override
  State<MapPage> createState() => _MapPageState();
}

class _MapPageState extends State<MapPage>
    implements NetworkAuthenticationChallengeHandler {

  @override
  void initState() {
    super.initState();
    // 2) Register this instance as the global network challenge handler.
    ArcGISEnvironment.authenticationManager.networkAuthenticationChallengeHandler = this;
  }

  @override
  FutureOr<void> handleNetworkAuthenticationChallenge(
      NetworkAuthenticationChallenge challenge) {

    // 3) Trust services.datafordeler.dk only when the OS doesn't trust its cert.
    if (challenge is ServerTrustAuthenticationChallenge &&
        challenge.host == 'services.datafordeler.dk') {
      challenge.continueWithCredential(
        ServerTrustNetworkCredential.forChallenge(challenge),
      );
      return;
    }

    // For other challenges (Basic/Digest/NTLM/Client cert), handle as needed
    // or fail so the error surfaces:
    challenge.continueAndFail();
  }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
      body: ArcGISMapView(
        controllerProvider: () => ArcGISMapView.createController()
          ..arcGISMap = ArcGISMap.withBasemapStyle(BasemapStyle.arcGISTopographic),
      ),
    );
  }
}

• ServerTrustAuthenticationChallenge is raised when the server cert is untrusted but the app can choose to proceed. [pub.dev]
• ServerTrustNetworkCredential tells the SDK to trust that host and retry; the credential is stored so subsequent requests to that host succeed. If you initialized a persistent NetworkCredentialStore, it’s kept across app restarts.

If you use a toolkit-based authenticator instead of handling the API directly, the toolkit also includes UI and handling for server‑trust prompts. [developers...arcgis.com]