How do you import CA certificates onto an Android phone?

Question

I want to connect to my University's wireless using my Nexus One. When I go to "Add Wi-Fi network" in Wireless Settings I fill in the Network SSID and select 802.1x Enterprise for the security and fill everything out.

The problem is that our university's wireless uses Thawte Premium Server CA certificate for certification.

When I click the drop down list for CA certificate I get nothing in the list (just N/A)

Now I have the certificate (Thawte Premium Server CA.pem) and have moved it to my SD card, but it doesn't look like Android automatically detects it.

Where should I put the certificate so that the Android wireless manager recognizes it. In other words, how can I import a CA certificate so that Android recognizes that it is on the phone and displays it in the CA Certificate drop down list.

Thanks for any help,

Tomek

P.S. My phone is not rooted

EDIT: After doing some research it looks like you are able to install certificates by going to your phone's settings > Location & Security > Install from SD card

Unfortunately it looks like the only accepted file extension is .p12. It does not look like there is a way to import .cer or .pem files (which are the only two files that come with the Thawte certificates) at this moment.

It does look like you can use a converter to convert your .cer or .pem files to .p12, however a key file is needed.

https://www.sslshopper.com/ssl-converter.html

I do not know where to get this key file for the Thawte certificates.

Answer 1

I've used RealmB's Android Certificate Installer to great success. You simply upload your PEM encoded (.cer or .pem) file and then point your phone's browser to the link that is provided. No need for a private key.

Answer 2

First: Android only understands binary format of CA and only with file format *.crt.
Second: Android only understands user certificates in *.p12 file format.

So You can check whether your CA file binary or text very simple: open it with any text editors^

If there something like 0‚ i0‚ Т , then it is binary.

If you see something like

Certificate: Data: Version: 3 (0x2) Serial Number: 96:0e:45:58:68:9a:bf:00 Signature Algorithm: sha1WithRSAEncryption Issuer: C=UA, ST=

Then it is text. It is very simple to convert it to binary by yourself in *nix:

openssl x509 -inform PEM -outform DER -in CA.pem -out CA.crt

Or just ask your system administrator.

Copy both CA.crt and usercert.p12 to your SD card or send it by email (if you have an email client configured on Android, usually downloaded attachments are stored in Download folder, actually it does not matter).

Go to Security and find option something like this: install certificate from your SD card

First install CA.crt, then usercert.p12

Go to wifi and make new connection, choose 802.1x EAP whatever and select your certificates for CA CA.crt and for user certificate usercert.p12 in my case I entered username as well.

Answer 3

http://abtevrythng.blogspot.com/2010/06/adding-cer-certificates-on-your-android.html

Shows how to actually achieve this. Worked fine for me. Try it out.

In this article .cer to .pfx (which is what you need on Android) conversion is given. Simple method is given using which you can convert .cer to .pfx and use it to connect to the Wi-Fi network. Plus you don't need any Key to convert .cer to .pfx!!!

Answer 4

For other people looking for this answer who can't use realmB's solution because they can't access the internet on their phone.
I just changed the file extension of my certificates from .cer to .crt and everything worked fine! Thanks to the users of this xda thread for the solution.

Answer 5

How do you import CA certificates onto an Android phone?

Android's official documentation can be found at Work with Certificates. Note that the certificate must be ASN.1/DER encoded. Once the encoding is correct, just ensure the extension is CRT or CER. If its not (like you named it ca-cert.der), then rename it (to ca-cert.crt).

If you have a PEM encoded certificate, then convert it to ASN.1/DER encoding using (per Dimtry's instructions):

openssl x509 -in ca-cert.pem -inform PEM -outform DER -out ca-cert.crt

If interested, the system Trust Store is burned into the ROM, so you really can't do modify it. When you modify the Trust Store, you are actually tweaking /data/misc/keychain and one of two files: cacerts-added and cacerts-removed. See Nikolay Elenkov's ICS Trust Store Implementation.

Answer 6

That's exactly the solution. Android accept only certificate in "Binary mode". If you have a certificate in Text mode, which is the most common certificate format, convert it simply in "DER Binary" format. After this, push the certificate into the "download folder of the Android device and use the "Install from SD Card" menu to install the certificate.

Works for Samsung Galaxy, Sony Xperia phone, HTC Phone Works for Android version 3.x and 4.x version

Olivier

Answer 7

I have managed to connect to my university network following the next steps:

1. Asked the university about certificate that it is used, in my case DigicertCA.
2. Google it, download it (I have it saved on my Dropbox account), save it in Download folder in phone (in my case Samsung Galaxy S8).
3. On the phone: go to Settings-> Lock Screen and Security-> Other Security Settings-> Install from Device Storage (Install certificate from storage) - if the certificate is downloaded on phone (Downloads folder in my case it is recognized and appear for selection).
4. Reboot the phone.
5. When configuring the network, at CA certificate, select Don't validate after installed on phone.

In my case it worked, hope it helps.

Answer 8

You can access your cer/pem from SD card with correct MIME type to be installed using TJWS (Android edition), so you do not need to upload your certificate to some web site.