diff --git a/CHANGELOG.md b/CHANGELOG.md
index 62051782..2298b1dd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+### Version 1.19.5
+* fixed connection loop on Android <4.4
+
 ### Version 1.19.4
 * work around for OpensFire’s self signed certs
 * use VPN’s DNS servers first
diff --git a/build.gradle b/build.gradle
index 054fc201..88acce65 100644
--- a/build.gradle
+++ b/build.gradle
@@ -56,8 +56,8 @@ android {
     defaultConfig {
         minSdkVersion 14
         targetSdkVersion 25
-        versionCode 227
-        versionName "1.19.4"
+        versionCode 228
+        versionName "1.19.5"
         archivesBaseName += "-$versionName"
         applicationId "eu.siacs.conversations"
     }
diff --git a/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java b/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
index 3fbdd3fe..6d5bb2a5 100644
--- a/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
+++ b/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
@@ -43,10 +43,9 @@ public class XmppDomainVerifier implements DomainHostnameVerifier {
 			}
 			X509Certificate certificate = (X509Certificate) chain[0];
 			final List<String> commonNames = getCommonNames(certificate);
-			final boolean isSelfSignedCertificate = isSelfSigned(certificate);
-			if (Build.VERSION.SDK_INT < Build.VERSION_CODES.KITKAT || isSelfSignedCertificate) {
-				if (commonNames.size() == 1 && commonNames.get(0).equals(domain)) {
-					Log.d(LOGTAG,"accepted CN in cert as work around for "+domain+" isSelfSigned="+Boolean.toString(isSelfSignedCertificate)+", sdkInt="+Build.VERSION.SDK_INT);
+			if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT && isSelfSigned(certificate)) {
+				if (commonNames.size() == 1 && matchDomain(domain,commonNames)) {
+					Log.d(LOGTAG,"accepted CN in self signed cert as work around for "+domain);
 					return true;
 				}
 			}