1

I can't import a new company-issued personal certificate in binary .p12 format. The old one worked fine, I have a new one (CA was updated so we had to be issued new ones) that fails the import.

Both have the same password and the old one imports fine, yet the new one doesn't. When the (correct) password is entered, it prompts for it again with "Type the correct password." error message. When I export it (from Firefox) with another password, it fails the same. If exported without password, Certificate Installer crashes ("Certificate Installer has stopped unexpectedly. Would you like to send an report to HTC? This will help us improve our products.)

I don't want to send report because I'm afraid of the certificate being leaked.

My Android version is 7.1.1, kernel 4.4.21-perf-g0a2f731cb614, Android security patch level June 1, 2017, the device is a stock unrooted up-to-date HTC U11.

I don't have any other Android device to test it on. The certificate imports fine in Windows, Firefox on Windows and Firefox on Linux.

Any suggestion on how to debug this? Is there a known incompatibility with some ciphering maybe?

Both the working old and not working new certificates are located for import in the same folder in the internal memory.

  • I'm here to report that, after yesterday's official OTA Oreo update of my HTC U11 (to Android 8.0.0 with November 1, 2017 Android security patch level, HTC Software number 2.33.401.10, kernel 4.4.78), the certificate installs and works fine and I can finally visit our company's internal systems from my Android Chrome. Hooray! I used the same certificate file with password that I unsuccessfully tried to install on Nougat, through Android Settings → Security → Encryption & credentials → Credential storage – Install from SD card. The fix may be in Oreo or slightly newer security patch or kernel. – LuH Jan 17 '18 at 18:06
1

Android Nougat doesn't allow to install user specific CA certificates. From Google blog:

By default, apps that target API level 24 will—by design—not honor such CAs unless the app explicitly opts in. This safe-by-default setting reduces application attack surface and encourages consistent handling of network and file-based application data.

  • This shouldn't be the issue, as both the old and working (importable) and new and not working ("wrong pass"/cert installer crash) are generated using a proprietary self-signed CA - it has just been upgraded. Is there any more info I can provide about the certificates? Re-tested the issue, still the same behavior on Android security patch level October 1, 2017. – LuH Nov 14 '17 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.