Google Support says:

The type of lock that's acceptable may be predetermined by your system administrator.

Where I can define what's acceptable? I can regenerate the certificate if needed.

So I can use slide lockscreen again.

(I'm using CM9 RC1, Android 4.0.4)

  • 1
    I will accept a solution that installs the certificate to system directly, thus bypassing the pin requirement.
    – rdlu
    Jul 9, 2012 at 15:09
  • 1
    To secure your credentials it's a requirement that you use one of the lockscreen types that has some kind of secret code (pattern, PIN or password). What that line is telling you is that your administrator can (normally via an Exchange ActiveSync policy) lock down your phone so that only some types of those are accepted, for instance they may not trust pattern-locks, and may think that 4-digit PINs don't have enough combinations. It's not saying that you can turn off this security requirement.
    – GAThrawn
    Jul 9, 2012 at 16:09
  • 2
    @GAThrawn I find that inacceptable if I just install a CA to authenticate my web servers via SSL (using self-signed certificates). I'd understand it if it were about signing keys on-device, or authenticating the user – but both are the other way around. Luckily, sgiebels solution seems to work for me, with some minor adjustments I've described in the comments there. Only drawback so far: it requires root.
    – Izzy
    Aug 10, 2014 at 14:49

6 Answers 6


The problem with disabling the lockscreen security using the toggle/profile is that the lockscreen widgets don't appear either so you can't slide to unlock. Also, when you reboot your phone the buttons don't work until you retoggle the setting again.

Another way is to install the certificate as usual then backup the /data/misc/keychain and keystore directories using something that preserves the ACLs such as Root Explorer to a location that supports ACLs. I suggest copying them to /tmp. Then clear the credentials from Settings and enable Slide To Unlock. Then copy back the folders from /tmp. The CA will be installed.

  • This does not work anymore. As soon as you try to use the certificate somewhere (such as in connecting to a wifi network) the OS requires you to set a lock on the screen again.
    – Cory Klein
    Nov 27, 2012 at 15:48
  • @CoryKlein If you click cancel it will prompt you for a PIN and you can enter the last one you set. It's needed to decrypt the data.
    – Monstieur
    Nov 28, 2012 at 1:35
  • @Kurian - So I followed the instructions above, and when I try to connect to a wifi network it says "You need to set a lock screen PIN", I click "Cancel", and nothing happens. If I hit "Ok" then cancel out from there, it still doesn't ask for the PIN.
    – Cory Klein
    Jan 8, 2013 at 21:35
  • @CoryKlein I misread your previous comment. I was talking about VPNs. Connecting to a VPN prompts you for the last lockscreen PIN to decrypt your credentials. I don't know if it works for personal certificates with private keys. I know it does work for installing trusted CA certificates. It might also be the specific ROM you're using. Pre-ICS AOSP ROMs never needed a lockscreen PIN for saving VPN credentials.
    – Monstieur
    Jan 16, 2013 at 3:49

I've described how to do exacly this on my page, "Installing CAcert certificates on Android as 'system' credentials without lockscreen - instructions" at http://wiki.pcprobleemloos.nl/android/cacert

I've also posted it on the cyanogenmod forum: http://forum.cyanogenmod.com/topic/82875-installing-cacert-certificates-on-android-as-system-credentials-without-lockscreen/

Basically, the commands are:

openssl x509 -inform PEM -subject_hash_old -in root.crt | head -1

To get the correct filename, then convert the certificate:

cat root.crt > 5ed36f99.0
openssl x509 -inform PEM -text -in root.crt -out /dev/null >> 5ed36f99.0

Copy them to /system/etc/security/cacerts/ and chmod the new .0 files to '644'. Reboot and verify. On your android device select 'Clear cerficates' and you are able to remove the pin (by entering the pin and changing your lockscreen to 'none' or 'wipe'

Here I used the CAcert root certificate, but you probably want the class3.crt certificate as well, or use your own certificates.

  • You mention "own certificates". I just tried it with my "CA" (created using TinyCA), and in the last step ("inform") only get an error: 140342119224992:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: TRUSTED CERTIFICATE. Checking with Unable to load certificate in openssl, the .pem file should be the match. But then, your last command changes nothing. Anything wrong, or is that expected for a self-signed/created CA? And before I start hacking: should that work nevertheless?
    – Izzy
    Aug 6, 2014 at 20:02
  • OK, worked and was accepted with my self-created TinyCA CA: openssl x509 -inform PEM -text -fingerprint -in cacert.pem > d6a2705a.0, then moving the base64 block to the top using a text editor, placing the file into /system/etc/security/cacerts/, running chown root:root d6a2705a.0 and chmod 0644 d6a2705a.0 from within the directory – et voila, it turns up as trusted system certificate. Yeehaa!
    – Izzy
    Aug 6, 2014 at 21:04
  • @sgiebels Do you by chance also have a solution how to use credentials (from the system credentials or other) in 802.1X WLAN connection? It seems like the keystore/keychain on the device (/data/misc/key...) use the password for encryption, thus: every time the credentials are needed (connecting to WLAN), the PIN/password is requested again an (in my system) the lock is on again.
    – Ivin
    Sep 9, 2014 at 8:04
  • This worked well except I also got an issue with the cert formatting due to dos line endings. dos2unix will convert them, then check you have the correct ending on certificate line (mine looked like this: -----END CERTIFICATE-----Certificate: which caused a parse error too.
    – deed02392
    Nov 13, 2017 at 12:22
  • Both links are dead! Is a Root device mandatory?
    – Dr.jacky
    Jan 9, 2023 at 0:11

I've discovered a solution that works without additional software or manual file copying:

  1. Set your lock screen to "pattern". Enter a pattern and an unlock PIN. Remember the unlock PIN.
  2. Install your user certificate.
  3. Turn the screen off and on.
  4. Enter the pattern wrongly a few times, until the "Forgot pattern?" option appears.
  5. Click "Forgot pattern?", scroll down, enter the unlock PIN and confirm with "OK".
  6. Close the "Screen unlock settings" window with the back button without selecting an option.

The system is now set to "Swipe unlock", but the user certificate is still usable (tested with the web browser and a custom app using DefaultHttpClient).

Tested on an Android 4.1.2 on a Galaxy Tab 2 10.1.

  • doesn't work with wpa-enterprise/TLS on LG G2, certs disappeared after this Nov 28, 2015 at 13:32
  • This is a great bug! Thanks! (worked perfectly with Galaxy S5, android 6)
    – Adiel
    Nov 15, 2016 at 9:14

Just wanted to add an answer that's a variant of guttermonk's for one particular use case: installing a certificate on a Bluestacks instance. At this writing the setting app for Bluestacks has been modified so that setting a pin or password is impossible, and so adding a user certificate is impossible also. But we can get a root certificate into the system with guttermonk's approach plus some other steps. I was able to install a certificate without a pin or password and without ever installing it in the user's certificate store.


  • Root privileges on the Bluestacks instance
  • openssl (on the host, e.g. as provided with Git Bash)
  • A terminal app in Bluestacks (e.g. Termux)

In my case, I had downloaded the cert file within Bluestacks and didn't have openssl available there. We can copy the file to the directory shared with Windows:

cp /sdcard/Download/mycert.cer /sdcard/windows/BstSharedFolder

In Windows we can use the openssl to get the hash of the certificate (I assume that's what this is).

cd C:\ProgramData\BlueStacks\Engine\UserData\SharedFolder # in CMD
cd /c/ProgramData/BlueStacks/Engine/UserData/SharedFolder # in Bash

openssl x509 -inform PEM -subject_hash_old -in mycert.cer | head -1
# e.g. abcd1234

Back in Android, we can make the system partition writable, copy the certificate to the system certificates directory, and fix up its permissions and ownership. Mount the system partition read only afterward, for safety.

mount -o rw,remount /system

cd /system/etc/security/cacerts/
cp /sdcard/Download/mycert.cer ./abcd1234.0
chmod 644 abcd1234.0
chown system:system abcd1234.0

mount -o ro,remount /system
  • You can make use of CyanogenMod's profiles.
    (For other readers: this needs the custom CyanogenMod Rom version 9+)

    Just create or modify an existing profile and switch off "screen lock" there.

    It's: System Settings->Profiles->Default->Lock screen mode->Disabled

  • Integrate your certificate into the standard Android keystore file

    See CAcert's excellent howto here

    I'm not sure however if you can do this with a self-signed cert (you might have to switch to a self-made CA maybe (use tinyca for a nice gui-tool on *nix)).

  • This does not work (anymore). As soon as you have installed certificates (e.g. the ones from cacert.org), this option/item in the profile is grayed out.
    – blueyed
    Apr 4, 2013 at 20:00

I found a way to solve the problem, but it requires root and may only work with root, self-signed, or intermediate CAs.

If you have a certificate that is not trusted by Android, when you add it, it goes in the personal cert store. When you add a cert in this personal cert store, the system requires a higher security level to unlock the device. But if you manage to add your cert to the system store then you don't have this requirement. Obviously, root is required to add a certificate to the system store, but it is quiet easy.

Here is how to do it :

1 - Add your cert normally. For example, my cert was called some.crt. It will be stored in your personal store and android will ask you a pin/password... Proceed.

2 - With a file manager with root capabilities, browse files in /data/misc/keychain/cacerts-added or /data/misc/keystore. You should see a file here called 1000_USRCERT_some it's the certificate you have added in step 1.

3 - Move this file to system/etc/security/cacerts (you will need to mount the system partition r/w)

4 - Reboot the phone

5 - You are now able to clear the pin/password you have set to unlock the device.

Worked for me with a self-signed cert on Android 4.4.2. Hope it helps!


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .