Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

There doesn't seem to be a central Android resource that lists the Trusted Root CAs included in the OS or default browser (related question on SO), so how can I find out which are included on my phone by default?

With the number of root certificates that have been compromised, and the number of fraudulent SSL certs created over the last couple of years, this is an issue for anyone relying on SSL for security, as otherwise you won't know if you want to remove any trusted CAs.

(not listing my manufacturer or OS version as I'm looking for a generic resource or solution that should be applicable to any device)

share|improve this question
1  
I have used this app (root required) to list and delete individual root certs: CACertMan or on Play Store. The guradian project also maintains an edited version of the standard keystore: github.com/guardianproject/cacert –  ce4 Jul 26 '12 at 14:02
    
Play Store link in previous comment is wrong - Here's the right one Play Store –  Michael Kohne Jul 26 '12 at 14:38
1  
@Michael: Thanks for the hint, seems I messed up with my copy/paste buffer (leaving the comment, as you and eldarerathis both provided the correct one) –  ce4 Jul 26 '12 at 14:44
add comment

2 Answers 2

up vote 7 down vote accepted

On ICS or later you can check this in your settings. Go to Settings->Security->Trusted Credentials to see a list of all your trusted CAs, separated by whether they were included with the system or installed by the user.

Earlier versions of Android keep their certs under /system/etc/security in an encrypted bundle named cacerts.bks which you can extract using Bouncy Castle and the keytool program. The summary is to first pull the bundle using adb (you need a root shell) then you can use Bouncy Castle to list the contents of the bundle:

shell~$ adb pull /system/etc/security/cacerts.bks`
shell~$ keytool -keystore cacerts.bks -storetype BKS -provider org.bouncycastle.jce.provider.BouncyCastleProvider -storepass changeit -v -list

There's also at least one app that you can try if you'd prefer not to use the shell: CACertMan (requires root to modify the list, but should allow you to view the list without root). I believe it came about due to the DigiNotar fiasco since there were no particularly easy ways for a user to revoke the cert at the time. Since the certs are stored differently on ICS and later this app will only work on devices running Gingerbread (or earlier), but it is obsolete on ICS/JB anyway.

share|improve this answer
    
Yep, it came because of DigiNotar. Root is only required for editing CAs out (e.g. Chinese state CAs), not for viewing I suppose (IIRC). –  ce4 Jul 26 '12 at 14:18
    
@ce4: I don't recall if you need root just to browse with CACertMan or not - I'll check that real quick. Update: Think you're right, I can list them if I deny it root access, I just can't save a modified list. I'll clarify that. –  eldarerathis Jul 26 '12 at 14:18
    
Is there a (rooted) way to edit/add certificates from the shell? The Settings method claims success on my tablet, but the certificates aren't actually installed. –  Michael Apr 10 at 17:19
add comment

From ICS onwards, go to Settings->Security->Trusted credentials.

share|improve this answer
2  
This is already covered in the previous answer (it is the first sentence, in fact). Please try not to duplicate content unnecessarily. –  eldarerathis Aug 9 '12 at 13:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.