1

I'm trying to install a user certificate on a pixel 7 running android 13 which will be used to connect to a website which requires mTLS. The CA and intermediate cert which signed the user cert are already installed on the phone and are visible in the User section under Trusted credentials. When trying to install the app user certificate (Settings => Security & privacy => Encryption & credentials => Install a certificate => VPN & app user certificate) I'm able to browse to the cert and select it, but it doesn't get installed. No error message is displayed, the phone simply reverts back to the VPN & app user certificate screen. I'm trying to install a pkcs12 bundle which contains the certificate and the private key.

Questions:

  1. Is VPN & app user certificate the correct place to install a user certificate that will be used for mTLS?
  2. What key and signature algorithms are supported for user certificates?
  3. Are there specific keyUsage and extendedKeyusage definitions that must be applied to the cert before android 13 will accept it?
  4. Is pkcs12 the correct format for installing a user certificate?
  5. What certpbe and keypbe algorithms are supported for pkcs12 on android 13?
  6. I've had to rename the file to .crt instead of .p12 in order for it to be able to select it from local storage. Is this the correct extension that should be used for a user certificate on android 13?
  7. Are there any log messages or other means of determining why the phone isn't accepting the pkcs12 file?
Improve this question
3
  • If the pkcs#12 file is password protected make sure not the new AES encryption is used as I don't know if Android supports it (the oldest 3DES is supported for sure). For the log you can check adb logcat from a connected PC, not sure if the import process will log messages there. You should also mention the used web browser because some browsers like Firefox use their own certificate store.
    – Robert
    Mar 6 at 22:04
  • Errors from logcat: "CredentialHelper: parseCert(): java.security.cert.CertificateException: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: java.lang.RuntimeException: error:0c0000be:ASN.1 encoding routines:OPENSSL_internal:WRONG_TAG CertInstaller: Attempting credentials installation, has ca cert? false, has user cert? false".
    – fcorrao
    Mar 6 at 22:47
  • The pkcs12 that generates that error on android 13 works fine on OSX. Can import and use it in multiple browsers w/ mTLS. I may need to answer some of the other questions to understand why android 13 won't accept it. pkcs12 has been generated with legacy and with current password encryption. Both fail, hence question #5.
    – fcorrao
    Mar 6 at 22:49

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .