14

I want Chrome to trust an SSL certificate. How do I add this certificate or its issuing authority to the system or browser so that Chrome will not generate an error upon trying to access the website that uses it?

Improve this question
1

1 Answer 1

Reset to default
10

Chrome is one of the few apps that trusts custom root CA certificates installed by the user.

First you need the custom root CA certificate. Usually it can be downloaded to your Android device. Place it e.g. in Downloads folder.

The following installation procedure is for Android 11 running a non-modified version of Google Android. On older phones or on phones that are running a heavily modified Android version (like used by Samsung and other manufacturer) the settings may be named different.

Therefore you can simply open Android Settings app and in the Security section select Encryption & credentials -> Install a certificate -> CA certificate. Then select the downloaded certificate.

You can verify that the certificate has been installed in Encryption & credentials -> user credentials.

Note that the installed custom root CA certificate will be only used by Chrome. Other apps will not accept it as by default modern apps (targeting Android 6+) don't trust certificates installed by users.

2023-06:

Recent versions of Chrome for Android no longer accept custom root CA certificates because Chrome now checks certificates additionally using the Certificate Transparency system.

Improve this answer
4
  • 1
    Is CT actually the reason Chrome doesn't accept custom CAs anymore?
    – lxgr
    Commented Sep 8, 2023 at 4:05
  • @lxgr to may understanding yes, CA is the reason.
    – Robert
    Commented Sep 8, 2023 at 6:55
  • If I use Firefox instead of Chrome, it is not working either on Android 11 (Waydroid). We have to approve the exception manually so there is still a warning "Connection is not secure" when clicking on the lock logo and it will not work for some websites using HSTS preload like Facebook. Is there a workaround?
    – baptx
    Commented Jan 6 at 18:38
  • I just found out that there were is a secret way to make Firefox trust user CA certificates installed in Android: it is hidden in the secret debug menu. If you activate this menu you can enable the option Use third party CA certificates. Normally clearing the browser cache should delete HSTS cert pinning entries, but I don't know if Firefox has some built-in pinned certificates for popular domains that are not deleted by clearing browser cache.
    – Robert
    Commented Jan 6 at 21:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .