How do I generate a PKCS12 CA certificate for use with Packet Capture?

Question

I was trying to use Packet Capture app to find out some URLs used by an app. Packet Capture allows you to capture SSL packets by installing a VPN Gateway with its own root CA certificate and then channeling app requests through that gateway. However, when I try to generate the certificate from within the app (on my Galaxy Note 8), I just get the error "Cannot create certificate". I don't know why this is as the app doesn't give any further explanation, but this means I can't use SSL capture in the app.

The app does have another way to just import an existing CA certificate, known as "Import PKCS#12 file". However I need to generate the PKCS#12 file myself to use this, and not sure how to do this.

What I did so far: I installed the app "Dory". Then I tried creating a public/private keypair, CSR and root CA certificate, all the time setting the passphrase and alias to "abc". But when I tried to import the p12 file to Packet Capture, it just said "java.lang.RuntimeException: Cannot load key. Password might be wrong." I must have done something wrong; what should I be doing next?

Answer 1

I had some issues with this after the Android 11 update. Android 11 no longer allows you to add certificates from any app other than the settings app, so you will have to generate and set the certificate yourself.

1. Generate the certificate in linux. You can also do this on the device if you get an openssl app or terminal. I followed this tutorial, except I added the name "alias" to the p12 key:

openssl req -x509 -newkey rsa:4096 -keyout myKey.pem -out cert.pem -days 365 -nodes

Hit enter for all the prompts

openssl pkcs12 -export -out keyStore.p12 -inkey myKey.pem -in cert.pem -name "alias"

Enter the password "test"

2. Transfer keyStore.p12 and cert.pem to the android device

3. In android settings, go to Biometrics and Security (note I have a Samsung device, it might be different for you) > Other Security Settings > Credential Storage > Install from device storage > CA Certificate > Accept the scary red warning and tap "Install anyway" > enter your pincode > find "cert.pem" and click "Done"

4. Going back to "Install from device storage," > VPN and app user certificate > find keyStore.p12 > Enter password "test" and name it "alias"

5. Go the the app info screen for Packet Capture > Permissions > Files And Media > Enable "Allow management of all files"

6. Open packet capture > Setting > Tap "No CA certificate" > Import PKCS#12 file > find keyStore.p12. Enter password "test" and the "alias". Restart packet capture. If everything worked, the "Status" subtitle should say "Installed to trusted credentials"

7. Restart device

SSL should work for most apps now but it can be hit and miss

Answer 2

I got it working on Android API 34 with the -legacy option as @JanWytze mentioned. Here's a simple script that will create the pair and push it to the device (password: test):

#!/bin/bash

# Step 1: Generate the certificate

# Generate a self-signed certificate and private key
openssl req -x509 -newkey rsa:4096 -keyout myKey.pem -out cert.pem -days 365 -nodes -subj "/C=US/ST=Some-State/O=Company Name"

# Export the private key and the certificate into a PKCS12 keystore using the -legacy flag
openssl pkcs12 -export -out keyStore.p12 -inkey myKey.pem -in cert.pem -name "alias" -passout pass:test -legacy

echo "Successfully generated keyStore.p12 and cert.pem"

# Step 2: Transfer files to Android device using adb

# Check if device is connected
if adb devices | grep -q device$; then
    adb push keyStore.p12 /sdcard/
    adb push cert.pem /sdcard/
    echo "Files transferred successfully to the device!"
else
    echo "No device found. Make sure your device is connected and USB debugging is enabled."
fi