Cyanogen OS 12.1 running on a ZUK z1. I added a self signed CA certificate to the "trusted credentials". Since then android doesn't allow me to use the fingerprint scanner to unlock the screen anymore. Is there any workaround to this security feature?

  • Is the device rooted? Otherwise AFAIK the answer is 2-letters: No.
    – Izzy
    May 20, 2016 at 11:52
  • Ouch. It is not rooted unfortunately May 20, 2016 at 11:53
  • Shall I place a "root solution" as answer nevertheless, so you can see whether it's worth it? On a rooted device, the solution is trivial (even if you're not familiar with shell/command-line). I do that on my devices all the time.
    – Izzy
    May 20, 2016 at 12:28
  • Yes please, post it. I just don't like tools like kingroot and success rate of rooting my device through other ways is still pretty low. May 20, 2016 at 12:41
  • I'd rather avoid those tools as well if possible, because of their side-effects (at least from what I've read about them). Will check with the answer, but must postpone it to when I'm back home – there are some subtle details I cannot reconstruct reliably without my notes :)
    – Izzy
    May 20, 2016 at 12:43

1 Answer 1


Step 1: Make the certs compatible (if they are not already)

At the very beginning we need to figure the file name of our the cert file. The name of the cert file is a hash one can obtain from the certificate itself. For this, one needs the openssl tools. On Unix/Linux the steps are then as follows:

# Obtain the hash – in my case that returned d6a2705a – so we have the file name
openssl x509 -inform PEM -subject_hash_old -in root.crt | head -1
# Copy the original file
cat root.crt > d6a2705a.0
# Append additional data
openssl x509 -inform PEM -text -in root.crt -out /dev/null >> d6a2705a.0

Step 2: Get the cert into our system cert chain

If your device is rooted, a solution to this is importing the certificate as system cert (not user-cert). You will need the command line for that, using either adb shell or a terminal app on-device. The following snippet assumes your certificate was already pushed to the SD card, saved as /sdcard/d6a2705a.0 (adjust that to your cert name), and you're at the command prompt of your device.

mount -o remount,rw /system
cp d6a2705a.0 /system/etc/security/cacerts/d6a2705a.0
chown root:root /system/etc/security/cacerts/d6a2705a.0
chmod 0644 /system/etc/security/cacerts/d6a2705a.0
mount -o remount,ro /system

Done. Now you should be able to use the cert – and as you do not have any "unsafe user certs", you're free to use whatever unlock mechanism you prefer.

A quick check shows all these steps are also described in the CaCert Wiki on how to create Android compatible certificate files from their original files. So my personal notes I took the above from might well originate here, at least partly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .