Cyanogen OS 12.1 running on a ZUK z1. I added a self signed CA certificate to the "trusted credentials". Since then android doesn't allow me to use the fingerprint scanner to unlock the screen anymore. Is there any workaround to this security feature?

  • Is the device rooted? Otherwise AFAIK the answer is 2-letters: No. – Izzy May 20 '16 at 11:52
  • Ouch. It is not rooted unfortunately – user3161330 May 20 '16 at 11:53
  • Shall I place a "root solution" as answer nevertheless, so you can see whether it's worth it? On a rooted device, the solution is trivial (even if you're not familiar with shell/command-line). I do that on my devices all the time. – Izzy May 20 '16 at 12:28
  • Yes please, post it. I just don't like tools like kingroot and success rate of rooting my device through other ways is still pretty low. – user3161330 May 20 '16 at 12:41
  • I'd rather avoid those tools as well if possible, because of their side-effects (at least from what I've read about them). Will check with the answer, but must postpone it to when I'm back home – there are some subtle details I cannot reconstruct reliably without my notes :) – Izzy May 20 '16 at 12:43

Step 1: Make the certs compatible (if they are not already)

At the very beginning we need to figure the file name of our the cert file. The name of the cert file is a hash one can obtain from the certificate itself. For this, one needs the openssl tools. On Unix/Linux the steps are then as follows:

# Obtain the hash – in my case that returned d6a2705a – so we have the file name
openssl x509 -inform PEM -subject_hash_old -in root.crt | head -1
# Copy the original file
cat root.crt > d6a2705a.0
# Append additional data
openssl x509 -inform PEM -text -in root.crt -out /dev/null >> d6a2705a.0

Step 2: Get the cert into our system cert chain

If your device is rooted, a solution to this is importing the certificate as system cert (not user-cert). You will need the command line for that, using either adb shell or a terminal app on-device. The following snippet assumes your certificate was already pushed to the SD card, saved as /sdcard/d6a2705a.0 (adjust that to your cert name), and you're at the command prompt of your device.

mount -o remount,rw /system
cp d6a2705a.0 /system/etc/security/cacerts/d6a2705a.0
chown root:root /system/etc/security/cacerts/d6a2705a.0
chmod 0644 /system/etc/security/cacerts/d6a2705a.0
mount -o remount,ro /system

Done. Now you should be able to use the cert – and as you do not have any "unsafe user certs", you're free to use whatever unlock mechanism you prefer.

A quick check shows all these steps are also described in the CaCert Wiki on how to create Android compatible certificate files from their original files. So my personal notes I took the above from might well originate here, at least partly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.