3

I'm trying to install a new user root CA certificate in DER form (.crt file) on Android 11, without much success. The previous (expired) CA certificate worked just fine from an earlier install on a previous Android version (I don't quite recall, probably 9 or 10), but the same procedure I used back then (Security > Encryption & Credentials > Install a certificate > CA certificate) now shows the following error message:

Private key required to install a certificate

The answer by Benedito Marques in this question works, but as the other commenters say this completely defeats the purpose of having a private CA with a private key. I do not want this key my device, do I have any solution?

6
  • You know that installing a user root CA certificate is useless as apps don't trust this CA by default?
    – Robert
    May 16, 2021 at 16:50
  • Ah, did that change in Android 11? It used to be this way on previous versions, can you point me to the docs for that?
    – F.X.
    May 16, 2021 at 17:04
  • No that is not something new. All apps targeting Android 7+ (API level 24+) ignore all user CA certificates by default.
    – Robert
    May 16, 2021 at 18:08
  • @Robert, This is also usefull in a case of establishing WiFi networking with WPA-Enterprise security via EAP-TLS. Without this flag (CA:True) is not possible to install, then select CA certificate in HotSpot properties.
    – A. Petrov
    Jul 1, 2021 at 12:43
  • @A.Petrov Establishing a connection to a WPA-Enterprise Wifi is done by the Android system not by an app. Therefore what I wrote is still true: installing a user certificate is useless for apps.
    – Robert
    Jul 1, 2021 at 12:45

1 Answer 1

9

This page pointed me to the right direction.

Android 11 can only install user-provided root CA certificates to contain the X.509v3 CA:true flag, which I suspect wasn't necessary before for some reason, and kept on working after the upgrade until I tried to install a new one because, presumably, the flag is not necessary to validate a TLS trust chain.


The following command can check if a certificate contains that flag (replace input format and filename by the one you are using).

$ openssl x509 -inform der -in cacert.crt -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ....
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = **, O = ***
        ...
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:TRUE
        ...

If CA:TRUE is not present under X509x3 Basic Constraints, your root certificate is likely not going to work on Android 11.


In order to generate a simple self-signed CA root certificate for Android 11, these minimal steps worked for me, and can be customized for your own certificate:

$ echo 'basicConstraints=CA:true' > android_options.txt
$ openssl genrsa -out priv_and_pub.key 2048
$ openssl req -new -days 3650 -key priv_and_pub.key -out CA.pem
$ openssl x509 -req -days 3650 -in CA.pem -signkey priv_and_pub.key -extfile ./android_options.txt -out CA.crt
$ openssl x509 -inform PEM -outform DER -in CA.crt -out CA.der.crt

The CA.der.crt or CA.crt files can be installed by going to Settings > Security > Encryption & credentials > Install a certficate.

Once installed, it appears proprely in the User certificates list, and all apps that try to connect to sites using that CA root succeed.

This answer appears to build on the same foundations but is much more complete and will probably work on more platforms, but the one above should be a good minimal working example.

3
  • I am able to create a CA cert based on your instructions and install it on Android. But for some reason when I create a site certificate based on the CA and put it on the server, I get a TLS error: unknown certificate authority. Any ideas? Would you mind showing how you generate a site cert using the CA you created above? thanks. Aug 5, 2021 at 19:46
  • @teleclimber Good question, did you append the CA cert at the end of the server subcert? I usually do something like cat server.pem ca.pem > /etc/nginx/cert.pem.
    – F.X.
    Aug 15, 2021 at 17:52
  • Thanks for your answer F.X. I think the problem is FireFox doesn't consider the OS trusted CA certs. It works in Chrome. Aug 16, 2021 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .