69

I want to connect to my University's wireless using my Nexus One. When I go to "Add Wi-Fi network" in Wireless Settings I fill in the Network SSID and select 802.1x Enterprise for the security and fill everything out.

The problem is that our university's wireless uses Thawte Premium Server CA certificate for certification.

When I click the drop down list for CA certificate I get nothing in the list (just N/A)

Now I have the certificate (Thawte Premium Server CA.pem) and have moved it to my SD card, but it doesn't look like Android automatically detects it.

Where should I put the certificate so that the Android wireless manager recognizes it. In other words, how can I import a CA certificate so that Android recognizes that it is on the phone and displays it in the CA Certificate drop down list.

Thanks for any help,

Tomek

P.S. My phone is not rooted

EDIT: After doing some research it looks like you are able to install certificates by going to your phone's settings > Location & Security > Install from SD card

Unfortunately it looks like the only accepted file extension is .p12. It does not look like there is a way to import .cer or .pem files (which are the only two files that come with the Thawte certificates) at this moment.

It does look like you can use a converter to convert your .cer or .pem files to .p12, however a key file is needed.

https://www.sslshopper.com/ssl-converter.html

I do not know where to get this key file for the Thawte certificates.

5
  • 1
    I wish this would be unclosed. It has been most helpful to me. Thank you to everyone on this page.
    – Ricket
    Jun 16, 2010 at 15:40
  • a .crt certificate also works fine
    – Lie Ryan
    Jul 12, 2011 at 10:34
  • 1
    On a HTC device with Android 2.3.5 I had to change the file extension from .pem to .crt. After that I could actually locate it from the Install from SD card option in the Security settings. It can be put in the root of the SD card or in the Downloads folder.
    – JJD
    Dec 4, 2014 at 14:32
  • Openssl should also be able to convert between various certificate formats.
    – snaut
    Oct 16, 2017 at 10:18
  • I answered a similar question here: stackoverflow.com/a/65888246/624814. Unfortunately I don't quite enough reputation on this channel to answer it.
    – SMBiggs
    Jan 25, 2021 at 16:25

8 Answers 8

18

I've used RealmB's Android Certificate Installer to great success. You simply upload your PEM encoded (.cer or .pem) file and then point your phone's browser to the link that is provided. No need for a private key.

3
  • That site itself tells if the upload is a valid certificate or not. It gave me invalid certificate error. I uploaded the one with right file permissions on my linux machine and it worked great.
    – so_mv
    Mar 7, 2013 at 0:49
  • 3
    The possible security implications of that site should be pointed out along with the link (or, cite that website itself: How is the security? - Bad, you should only upload files that you feel can be publicly viewed without any side effects.). Dec 20, 2013 at 13:16
  • This no longer works :( Upload failed
    – Vitas
    Jan 10, 2017 at 9:13
11

First: Android only understands binary format of CA and only with file format *.crt.
Second: Android only understands user certificates in *.p12 file format.

So You can check whether your CA file binary or text very simple: open it with any text editors^

If there something like 0‚ i0‚ Т , then it is binary.

If you see something like

Certificate: Data: Version: 3 (0x2) Serial Number: 96:0e:45:58:68:9a:bf:00 Signature Algorithm: sha1WithRSAEncryption Issuer: C=UA, ST=

Then it is text. It is very simple to convert it to binary by yourself in *nix:

openssl x509 -inform PEM -outform DER -in CA.pem -out CA.crt

Or just ask your system administrator.

Copy both CA.crt and usercert.p12 to your SD card or send it by email (if you have an email client configured on Android, usually downloaded attachments are stored in Download folder, actually it does not matter).

Go to Security and find option something like this: install certificate from your SD card

First install CA.crt, then usercert.p12

Go to wifi and make new connection, choose 802.1x EAP whatever and select your certificates for CA CA.crt and for user certificate usercert.p12 in my case I entered username as well.

2
  • 2
    To whoever this might help in the future: I had no problem installing a text format certificate on an SGS4 - but only after I had moved it to the Downloads folder (My Documents wouldn't do) and also only with the option indicated in the question, not by opening the CRT file from a file manager, where Android claimed the file type was unknown (unlike on Nexus 7, where it did work like that). Dec 20, 2013 at 13:13
  • I had to use the Root Cert, not the site cert when saved from Chrome. From a chrome page: F12 (dev console), Security tab, View Certificate, Certification Path tab, click top-most root node, View Certificate, Details tab, "Copy to file..." button, choose DER format. Opening from google drive let me install the cert. Verify it shows up on phone in Settings, Security, Trusted credentials, User. May 12, 2017 at 19:19
5

http://abtevrythng.blogspot.com/2010/06/adding-cer-certificates-on-your-android.html

Shows how to actually achieve this. Worked fine for me. Try it out.

In this article .cer to .pfx (which is what you need on Android) conversion is given. Simple method is given using which you can convert .cer to .pfx and use it to connect to the Wi-Fi network. Plus you don't need any Key to convert .cer to .pfx!!!

0
5

For other people looking for this answer who can't use realmB's solution because they can't access the internet on their phone.
I just changed the file extension of my certificates from .cer to .crt and everything worked fine! Thanks to the users of this xda thread for the solution.

1

How do you import CA certificates onto an Android phone?

Android's official documentation can be found at Work with Certificates. Note that the certificate must be ASN.1/DER encoded. Once the encoding is correct, just ensure the extension is CRT or CER. If its not (like you named it ca-cert.der), then rename it (to ca-cert.crt).

If you have a PEM encoded certificate, then convert it to ASN.1/DER encoding using (per Dimtry's instructions):

openssl x509 -in ca-cert.pem -inform PEM -outform DER -out ca-cert.crt

If interested, the system Trust Store is burned into the ROM, so you really can't do modify it. When you modify the Trust Store, you are actually tweaking /data/misc/keychain and one of two files: cacerts-added and cacerts-removed. See Nikolay Elenkov's ICS Trust Store Implementation.

0

That's exactly the solution. Android accept only certificate in "Binary mode". If you have a certificate in Text mode, which is the most common certificate format, convert it simply in "DER Binary" format. After this, push the certificate into the "download folder of the Android device and use the "Install from SD Card" menu to install the certificate.

Works for Samsung Galaxy, Sony Xperia phone, HTC Phone Works for Android version 3.x and 4.x version

Olivier

0

I have managed to connect to my university network following the next steps:

  1. Asked the university about certificate that it is used, in my case DigicertCA.
  2. Google it, download it (I have it saved on my Dropbox account), save it in Download folder in phone (in my case Samsung Galaxy S8).
  3. On the phone: go to Settings-> Lock Screen and Security-> Other Security Settings-> Install from Device Storage (Install certificate from storage) - if the certificate is downloaded on phone (Downloads folder in my case it is recognized and appear for selection).
  4. Reboot the phone.
  5. When configuring the network, at CA certificate, select Don't validate after installed on phone.

In my case it worked, hope it helps.

-1

You can access your cer/pem from SD card with correct MIME type to be installed using TJWS (Android edition), so you do not need to upload your certificate to some web site.

You must log in to answer this question.