From StackOverflow: How to install trusted CA certificate on Android device?
I spent a lot of time trying to find an answer to this (I need Android to see StartSSL certificates). Conclusion: Android 2.1 and 2.2 allow you to import certificates, but only for use with WiFi and VPN. There is no user interface for updating the list of trusted root certificates, but there is discussion about adding that feature. It’s unclear whether there is a reliable workaround for manually updating and replacing the cacerts.bks file.
Details and links: http://www.mcbsys.com/techblog/2010/12/android-certificates/. In that post, see the link to Android bug 11231 --you might want to add your vote and query to that bug.
11231 was closed in November of 2011 and the status was Released for Android 4.0 ICS.
Here are the notes associated with the Released status:
ICS does attempt most if not all of the items in this issue. If I missed anything, I'll open more specific issues to address the gaps.
Some details below, I plan a more formal blog post later. The following should all be visible in the Android 4.0 SDK if you want to try them out and give feedback.
Changes in Settings:
- system certificate authorities (CAs) are now visible in Settings > Security > Trusted Credentials.
- system CAs can now be disabled and reenabled
- users can install their own CAs from Settings > Security (as well as other mechanisms such as via browser or opening from email attachment.
- user CAs can be viewed and deleted in Settings > Security > Trusted Credentials
- instead of a separate 8 character PIN for credential storage, access is now controlled via the lock screen
New KeyChain API
- KeyChain.createInstallIntent allows applications to request credential installation in, basically making public the interface used by Settings to request installation. users need to confirm installation requests as before.
- KeyChain.choosePrivateKeyAlias/getPrivateKey/getCertificateChain allow applications to request private keys and their associated certificates for application use. a common use case would be for client certificate authentication with https.
- Email now uses the KeyChain API to allow client certificate authentication for Exchange accounts
- Browser will now use the KeyChain to prompt for a client certificate when the server requests one for authentication.
In March 2014, an enhancement request was created Allow users to install own CA certificates.
Many users (including companies) use self-signed certificates for SSL/TLS, either because they don't want to pay for it or because they just don't trust other companies and want to do it themselves (actually, there's no reason to buy a certificate when it's not required that anonymous Internet users trust your server).
At the moment, it's possible install a custom CA certificate in Android, but it's detected as "user certificate" which seems to be intended for client-side certificates. As a result, these certs are shown as "user certificates" in the GUI and since Android 4.4, a terrible "Network may be monitored" has been implemented.