Why does android get the wrong ssl certificate? (two domains, one server)

The most likely cause for this problem is that the server uses Server Name Indication to choose which certificate to send. If the client doesn't support SNI, the server cannot choose which certificate to send during the SSL/TLS handshake (before any HTTP traffic is sent). SNI is required when you want to use multiple certificates on the same IP address and port, but not all clients support it (notoriously, IE on any version of Windows XP, and a number of mobile browsers).

You're also visibly using the Apache HTTP Client library (not HttpsURLConnection, for which there can be SNI support with some Android versions.Support for SNI in the Apache HTTP Client library is quite recent, and certainly hasn't made it into the Android stack.

You may find the workaround described in this article useful (although it seems only to work for Android 4.2+).

Another two options would be:

• to use a distinct IP address for each host (so as not to need SNI), if you're in control of server, or
• to use another HTTP Client library (e.g. HttpsURLConnection).

A solution for Apache, more like a trick:the SSL certificates are loaded based on the vhost name from /etc/apache2/sites-enabled. So, to trick that check make sure the problematic certificate is loaded first (remember that the vhosts are loaded by name).

It looks like the certificate of foo.net is misconfigured, and is using the same hostname as bar.com

Try to run an online certificate validation tool, like https://www.digicert.com/help/ on foo.net, just to be sure.

I think that you need to regenerate the certificate of foo.net with the right hostname, or reconfigure ngix to make sure that nginx serve the right certificate for the right host.