Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From the current fallout around DigiNotar (in short, a Root Certificate Authority that has been hacked, fake HTTPS certificates issued, MITM attacks very likely), there are some parts concerning Android (see yesterday's interim report in PDF):

  • fraudulent certificates for *.android.com has been generated (which would include market.android.com)
  • there may be other such fraudulent certificates signed by this CA in the wild (currently nobody knows for sure, one way or the other)
  • this could happen to another CA in the future (Comodo had a similar problem a few months ago)

So, how do I remove a CA I no longer trust from my Android phone? (I have root and CM6 on my specific phone, if that's relevant)

share|improve this question
1  
CM team are working on a fix according to code.google.com/p/cyanogenmod/issues/detail?id=4260 – Sparx Sep 7 '11 at 17:16
up vote 5 down vote accepted

Lookout Mobile has blogged about this due to the DigiNotar events, and provided some pretty good (read: lengthy) instructions which you can find here.

The gist of it is that you need to pull /system/etc/security/cacerts.bks and then remove the CAs from the store, then push the store back to the device and reboot. Their instructions require that you have Bouncy Castle (for decrypting the store), root access, and a working adb connection. I'm not sure if this applies to all versions of Android or not, but my guess would be that the location of the CA store hasn't changed in quite some time (if ever).

share|improve this answer
2  
In your list of requirements of important entry for some devices is missing: You need an unprotected system partition (also known as "S-OFF"). If an S-ON system the command "adb remount" will not work. – Robert Sep 22 '11 at 13:38

Click on the name of the credential, scroll down and then press turn off.

share|improve this answer
4  
I think you meant "Disable" instead of "turn off". However, please also indicate the Android version and brand since not all version have this feature. – Andrew T. Nov 10 '14 at 6:32
    
I think this would be in "System settings > Security > Trusted Credentials". At least this is on my Android 4.1.2. – rcdmk Apr 21 '15 at 22:10

In Android Lollipop 5.0
Settings → Security → Trusted credentials → User tab → Select your certificate → Scroll down, Click on Remove button → Done.

share|improve this answer
    
Good to know if you're on a recent Android version, thanks. (I understand this is a feature introduced in 5.0, correct?) – Piskvor Dec 2 '15 at 10:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.