5

This is a follow up question related to this answer.

In short: I am importing the self signed Root CA certificate into android system via

Settings -> Security -> Trusted Credentials -> install from SD

path slightly differs on different android versions.

Then point any browser (tested with Firefox, chrome and opera) to the secure (java script based) resource and I receive a socket error. The resource is an index.html with js web-socket logic to securely connect to a mosquitto broker.

If I on the other hand point the browser to "https://myserver:<mysecure port>" I receive a privacy warning, can continue unsafe and this somehow sets a cookie or other storage thing thus I am able to do future requests over the js based secure resource.

It feels, that browsers on android do not make use of the system's user imported CA certificates although they are listed in the trusted certificates "user" tap and in the trusted credentials area.

Tested with android 7.1.2 and 10. All desktop browsers work fine, tested on ubuntu / mint & raspi.

How to accomplish browser based TLS requests on android without accepting unsafe privacy risks?

Additional test:

I've tested the same thing on a ios 13.3 IPhone 7, importing the CA certificate, putting the secure resource on a proper web space since local file access isn't possible on ios. Worked out of the box.

So it seems to be a real android issue. It might make sense to put this question to an android space. Could someone make a suggestion please?

Further research:

Here is a detailed explanation, on how to get a custom certificate into the system's certificate section. But to be honest, that's not a usual way to go. Root access is not for ordinary mortals plus it might not work for more recent android versions.

User certificates are for android applications written by your own. You can have a view lines of property settings in app.config to work with your self signed user certificates.

Chrome browser and others on the other hand are kind of system applications or applications from vendors not being made to be aware of specific user certificates. And that's the only valid reason, why it will not know of certificates in the user section. It only knows of system certificates.

So the only way remaining, seems to be making your own application or somehow recompile a whole browser application configuring it to look for user certificates.

This is quite cumbersome and unsatisfying, since the web would give you all you need on any device, except android of course, which forces a detour.

Improve this question
6
  • 1
    I recall a similar issue, whereby the system managed certificate store differs from the user managed certificate store. You'd need to root the device to modify the system cert store, otherwise you can't get your root CA in. There's also the possibility that you'd need to explicitly trust the certificate like you need to on iOS. But I haven't done any of this in a while so wouldn't know the details.
    – Pedro
    Commented Jul 1, 2020 at 12:39
  • @Pedro: yes seems so and I got a valuable resource which manifests the assumption. I'll edit my question
    – woodz
    Commented Jul 1, 2020 at 20:31
  • For reference, I have an Android 10 phone with a user trusted CA certificate installed and am able to access internal sites with CA issued certificates without a problem, using all but Firefox (which uses it's own CA list, not the phone's). I'm afraid I can't think of anything that would cause this problem on specifically a phone when desktops work fine though. Browsers tested on my phone were Chrome and Edge. Presumably you installed for "VPN and Apps" and rebooted your device?
    – Unencoded
    Commented Jul 2, 2020 at 18:16
  • @Unencoded: to your questions, yes I did. Tried also for WiFi but this results in nothing listed under trusted certificates "user" tap and in the trusted credentials. So this way has zero relevance. I'll give it another try
    – woodz
    Commented Jul 2, 2020 at 18:23
  • Yes I doubted it would be so simple, you have certainly done your research! All I can think of is looking at Android apps that may help you debug why the certificate isn't trusted - perhaps play.google.com/store/apps/…
    – Unencoded
    Commented Jul 2, 2020 at 18:33

3 Answers 3

Reset to default
5

This worked for me on Firefox 97.3.0:

  1. Install the self-signed CA certificate into Android (for me, this was under Settings -> Biometrics and security -> Other security settings -> Install from device storage -> CA certificate). My certificate had to be DER format.
  2. Open up Firefox Settings -> About Firefox
  3. Click on the logo 5 times (until "Debug menu enabled" popup appears)
  4. Go back to Settings - there should be a "Secret Settings" option now. Choose that.
  5. Enable "Use third party CA certificates"
Improve this answer
3
  • Thank you! this seems to be the only way to show a self-signed site without the warning in modern Android devices, thank you again
    – anibal
    Commented May 26, 2023 at 3:26
  • I can confirm it works on Firefox 115.0.1. Thank you!
    – vcampitelli
    Commented Jul 13, 2023 at 1:47
  • I tested with Firefox 121.0.1 version on Android 11 (Waydroid) but we have to approve the exception manually so there is still a warning "Connection is not secure" when clicking on the lock logo and it will not work for some websites using HSTS preload like Facebook. Is there a workaround? Chrome has the same issue.
    – baptx
    Commented Jan 6 at 18:34
0

Firefox on Android

You don't have to add your custom root CA certificate to Android to let Firefox trust it. Similar to the Desktop Firefox versions Firefox maintain an own root CA certificate store you can add certificates to.

The only difference to the desktop version is that there is not management UI for adding certificates.

Instead you simply have to download a root CA certificate (DER format not PEM format) using Firefox Mobile then a dialog appears where you can mark the certificate as trusted for identifying web sites and/or mark the certificate as trusted for identifying e-mail users (pretty useless on Firefox on Android but it can be selected).

enter image description here

Improve this answer
3
  • 1
    Hello, is this answer still supposed to be good today? I have installed both Firefox (86.1.1), and Firefox nightly (310302 17:01). When my site delivers to Firefox a CA in the shape of a .pem file (as an a tag: <a href="/devCA.pem">), the only option I get is to download that file. Once downloaded, I can only open it, which sends me to the system wide certificate management, at no point I am offered to load this in Firefox? I've tried adding a html propertyto the a tag: type="pem-certificate-chain" to no avail
    – Will59
    Commented Mar 3, 2021 at 14:12
  • @Will59 yeah this seems to be broken now, and poorly documented in general. Did you find a solution?
    – Cylindric
    Commented Mar 28, 2021 at 19:18
  • @Cylindric no unfortunetaly I have had to give up on that, no solution so far.
    – Will59
    Commented Mar 30, 2021 at 7:05
0

The only workaround I found to intercept HTTPS traffic on Android 11 (Waydroid) even if the website uses HSTS preload is to use the default Android web browser but there was an error ERR_UNKNOWN_URL_SCHEME to open apps from the browser URL scheme (necessary to log in on some apps) so I have to save the login link in an HTML file (for example with nano in Termux) that I open with another web browser like Chrome to click on the link. Simply copy-pasting the link in other browser URL bar did not work. To make the login work, the app needs to be in a state where it is waiting for the login link.

Here are other answers I found useful to make it work:

https://stackoverflow.com/questions/13644712/launch-application-from-browser-url-scheme/13646068#13646068

Is it possible to create a plain text file in android?

Improve this answer

You must log in to answer this question.