I'm trying to install a user certificate on a pixel 7 running android 13 which will be used to connect to a website which requires mTLS. The CA and intermediate cert which signed the user cert are already installed on the phone and are visible in the User section under Trusted credentials. When trying to install the app user certificate (Settings => Security & privacy => Encryption & credentials => Install a certificate => VPN & app user certificate) I'm able to browse to the cert and select it, but it doesn't get installed. No error message is displayed, the phone simply reverts back to the VPN & app user certificate screen. I'm trying to install a pkcs12 bundle which contains the certificate and the private key.
Questions:
- Is VPN & app user certificate the correct place to install a user certificate that will be used for mTLS?
- What key and signature algorithms are supported for user certificates?
- Are there specific keyUsage and extendedKeyusage definitions that must be applied to the cert before android 13 will accept it?
- Is pkcs12 the correct format for installing a user certificate?
- What certpbe and keypbe algorithms are supported for pkcs12 on android 13?
- I've had to rename the file to .crt instead of .p12 in order for it to be able to select it from local storage. Is this the correct extension that should be used for a user certificate on android 13?
- Are there any log messages or other means of determining why the phone isn't accepting the pkcs12 file?
adb logcat
from a connected PC, not sure if the import process will log messages there. You should also mention the used web browser because some browsers like Firefox use their own certificate store.