Problem importing server certificate to CyanogenMod 9.1

Question

I am having trouble importing a self signed server certificate to my Sony Ericsson Xperia Arc S running CyanogenMod 9.1. I have tried everything that came to mind.

First, the usual method:

• downloaded certificate in PEM format as cert.crt using FireFox on the SD card root
• opening Settings on the phone, then Security, install from SD card.
• phone asks for name, I give it and then the phone shows message that the certificate was successfully installed
• if I go to Trusted Credentials -> User, certificate is not there and the site I downloaded it for still shows as untrusted
• I also tried importing by uploading the certificate on the site and downloading it in the Android browser - same result - success message and now certificate imported.

Second, I tried to get it into the system certificates

• first, the conversion with these commands (first command shows the hash used in the other two):

  openssl x509 -inform PEM -subject_hash_old -in root.crt | head -1 
  cat root.crt > 5ed36f99.0
  openssl x509 -inform PEM -text -in root.crt -out /dev/null >> 5ed36f99.0
  

• then I moved certificates on the phone, remounted /system with write permissions, moved certificate to /system/etc/security/cacerts/ and changed its permissions to 655. Reboot.

• After reboot, certificate shows itself correctly in trusted credentials system tab, but the website still appears untrusted.

The question is, is there another option to install the certificate, or to disable certificate check for site system-wide (I need an application to access this site also). Or does someone have a similar problem?

I should add that I also own an Xperia Arc (without S) running CyanogenMod 9.0, where the certificates are actually working via the first two methods.

Answer 1

I'am having trouble importing a self signed certificate to my Sony Ericsson xperia Arc S running Cyanogenmod 9.1...

AOSP/Android does not support self signed server certificates for the system's Trust Store, and they make it (nearly?) impossible to import them. I know you can't import them for use in, for example, com.android.browser. Also see this related stack exchange question: Self-signed certificate install claims success, but android acts as if cert isn't there.

If you want to certify one of your servers, you have to become your own CA. You will be able to import your own CA's certificate. Also see Work with certificates on Google's Android help. Notice they work with CA and client certificates; but not self signed server certificates.

The browser's unwillingness to use self signed server certificates will be a pain point for the Internet of Things (IoT), where you try and connect to your refrigerator or thermostat to program it. The W3C's working group has not even begun to tackle the problem. See Proposal: Marking HTTP As Non-Secure on the W3C mailing list.

If you want to become your own CA, then see questions like How do you sign Certificate Signing Requests with your Certification Authority? and How to create a self-signed certificate with openssl?.

---

I tried to get it into the system certificates ....

The system Trust Store is burned into the ROM, so you really can't do anything with it. When you modify the Trust Store, you are actually tweaking /data/misc/keychain and one of two files: cacerts-added and cacerts-removed. See Nikolay Elenkov's ICS Trust Store Implementation.