Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I have a Nexus 7 (Android 4.1.1) and I want to add a CA (Certificate Authority) to my device to use it for the ssl-connection to my mail server. The CA is self-signed. The Certificate does only contain the public key of the CA (of course!).

I also want to keep my screenlock disabled because on a tablet not leaving my house it does not make sense to have a screen lock.

Now the problem arises: Whenever I want to import the CA, Android wants me to change my screenlock to digits/password which I want to avoid.

Can this behaviour somehow be prevented? There is nothing security critical at a public key of a CA.

I know that when the phone is rooted one can add a CA, but I want to avoid rooting my phone.

share|improve this question
I think this was closed because a complete answer to the other question would include a non-root method if one was possible. In the hopes of getting such an answer we don't want to divide attention between that one and this one. In this case though I don't think it will hurt to reopen this, consider linking to the other and explaining the difference though :) –  Matthew Read Sep 6 '12 at 15:35
Not sure if this has anything to do with screen lock, which I didn't need on my Android 4.3.1. To create & install a certificate, maybe my answer to this question might be helpful. –  FriendFX May 28 '14 at 9:58

5 Answers 5

I've written an article on creating & installing CAcert certificates as Android System Certificates (Android >=4.2), thus allowing you to use your device without lockscreen:


Main part of my article:

cat root.crt > 5ed36f99.0
openssl x509 -inform PEM -text -in root.crt -out /dev/null >> 5ed36f99.0
cat class3.crt > e5662767.0
openssl x509 -inform PEM -text -in class3.crt -out /dev/null >> e5662767.0

Copy the files 5ed36f99.0 and e5662767.0 to /system/etc/security/cacerts/ (and chmod 644 them), reboot and it should work. Check Settings -> Security -> Certificates, it should list both "CAcert Inc." and "Root CA". Note that some browsers might use their own certificate store instead of the Android one.

The Android security model explicitly forces you to have a lockscreen whenever a non-system (user) certificate is installed. There is no configuration option around this.

You can either replace your stock Android version with one which has removed this requirement (I do not think that any exist, but you could theoretically create your own).

The other option is using (temporary) root access for installing this certificate, and then 'unrooting' it, although that sounds a bit silly.

share|improve this answer

There is no way I know of which will achieve this. I've been looking for a way of doing the same thing for a while now, as my work requires me to use a CA, but have found nothing after a lot of looking. If you were rooted then it might be possible, but without root I'm afraid you're going to have to just deal with it.


share|improve this answer

In case you decide to root the phone (you can only root it temporarily to install the certificates, it doesn't need to remain rooted), you can upload the certificates into a directory and the next reboot they will be validated:

adb shell mount -o remount,rw /system
adb push 1dbdda5d.0 /system/etc/security/cacerts/

where 1dbdda5d.0 is your certificate to be trusted.

share|improve this answer
The author stated that he doesn't want to root his phone. Besides this, I'm pretty sure, that adding just the single file to this directory won't work. The certificate must be included into the /system/etc/security/cacerts.bks key store to be visible for Android. See CACert's howto if you want to know the steps needed. –  ce4 Dec 12 '12 at 10:51

Sorry, root access is require AFAIK. For everybody who has root access and Android 4+, here a detailed description how to add it to Android's system certificate folder:

Assuming your certificate file - let's call it root.cer - looks like this:


Obtain the name Android needs for it (".0" is appended) and store in variable $name:

name=$(openssl x509 -inform PEM -subject_hash_old -in root.cer | head -1).0

Sample output for: echo $name


Create the certificate file for Android:

cat root.cer > $name
openssl x509 -inform PEM -text -in root.cer -out /dev/null >> $name

Copy certificate file to SD card:

adb push $name /sdcard

Open Android shell:

adb shell

Become root and copy certificate to Android's system certificate folder:

mount -o remount,rw /system
cp /sdcard/00673baa.0 /system/etc/security/cacerts/

Note: For the last command you need to replace the certificate file name!

Now reboot. Make sure that the certificate was correctly installed: Goto Settings -> Security -> Show trusted certificates. Here in the system list you should find the name of the issuer of your self-signed certificate (which is equal to the subject). You can print it using:

openssl x509 -inform PEM -issuer -in root.cer -out /dev/null

Now you can delete all certificates (system certificates are not touched) and remove the lock screen.

share|improve this answer

There is a way. Just install your certificate the usual way and set "Patterns" as lock screen to do so. Lock the screen. Fail on the patterns 5 times, then click on "forgot pattern" in the lower right corner, login with your Google account and voilà ... the lock screen is reset to "none" and certificates are still there.

Just tested it on Galaxy Note N7000 with 4.1.2

share|improve this answer
Could you explain further? How does this help me with installing a CA? Do I have to do this everytime the keylock is visible? –  theomega Jan 10 '13 at 10:10
There is no "forgot pattern" after failing 5 times on Nexus running stock Android though. –  Andrew T. Jan 30 at 4:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.