Hot answers tagged

19

I had the same problem getting Android to really install the certificate, until I found this site which describes a method that worked for me. It boils down to the following steps: Create a private key and public x509 certificate with v3_req extensions and enabled as a CA: sudo openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /etc/ssl/private/...


5

Assuming you are not doing Android development, you do not need to worry about Android version. Any serious security-minded application like Chrome on Android will use TLS 1.2. You can verify this for yourself by going to a secure website (make sure it supports TLS 1.2!) and inspecting the certificate and protocol used on the client. I have checked this on ...


4

HTTP error 500 indicates a server problem. You should report the problem to the owner of the website so they can fix it. Some sites deliberately behave differently for different browsers and OSes, so that could be triggering the problem at the server. There's one more possibility, if you're using mobile data (instead of Wi-Fi) to access the site. Most ...


4

Firefox 47 can be installed on the 1st generation Kindle Fire. It supports TLS 1.2. Download link: Mozilla's official FTP.


3

This question is a near duplicate of questions like this and this, and closely related to this and this. In fact it can be better explained by a developer, but since it keeps on appearing again and again with slightly different situations, I'll try to explain what I know with some unnecessary details to make the picture clear from a broader perspective. In ...


3

Android devices are only susceptible to this bug if they connect to servers which have not updated their server-side OpenSSL components. If the server component of OpenSSL is secure, no data is leaked. Therefore the main focus of this vulnerability is to server admins, not individual users. Most probably this can be fixed with app updates as a temporary fix,...


2

Go to Settings > Security > Credential storage > Install from SD card. If it's not there you may need a newer Android version or a workaround which I don't know about.


2

From StackOverflow: How to install trusted CA certificate on Android device? I spent a lot of time trying to find an answer to this (I need Android to see StartSSL certificates). Conclusion: Android 2.1 and 2.2 allow you to import certificates, but only for use with WiFi and VPN. There is no user interface for updating the list of trusted root certificates, ...


2

Latest Udate 2020-12-21 Let's Encrypt has delayed the new root CA certificate for 3 years: We’re happy to announce that we have developed a way for older Android devices to retain their ability to visit sites that use Let’s Encrypt certificates after our cross-signed intermediates expire. We are no longer planning any changes in January that may cause ...


2

The problem with the root-CA certificate is not the only one you are facing: Devices with Android version 4.4 and before have problems accessing a lot of https sites because they do not support TLS 1.2. More and more web sites require that TLS version now as the older versions (SSLv3 TLS1.0 TLS1.1) have known security problems and there is a recommendation ...


1

Yes, you can do it on your phone alone. I use HttpCanary App with root access. It works without root as well but only a few apps that don't use certificate pinning.


1

SSL/TLS support is based on the Android version. There's no way for Android end-users to fix this issue unless to upgrade to a newer Android version if possible. In this case, based on Qualys SSL Server Test, the site only supports TLS 1.2. TLS 1.2 is only supported since Android 4.4.2 KitKat, where Android 4.3 Jelly Bean and before only supports TLS 1.0 (...


1

The generated APK file by apktool needs to be signed before you can install it on a Android phone or emulator: First you have to create a key-pair for signing stored in a keystore (only required once): keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000 Note this command uses keytool for JDK. ...


1

As tipped by @beeshyams, HttpCanary is perfect for this. You need a rooted device, of course. HttpCanary takes care of all of the difficult steps (certificate generation and installation) transparently. It shows a list of requests (filterable by app), and details of each request and response. The best feature is this overlay showing request while I am using ...


1

A certificate authority signs digital certificates. Often times companies will pay an internationally trusted CA such as VeriSign or DigiCert to sign certificates on their own domain. In some cases it may make more sense to act as your own CA, rather than paying a CA like DigiCert. Your university is doing exactly that, ie using their own certificate ...


1

From the article you posted: OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable OpenSSL 1.0.1g is NOT vulnerable OpenSSL 1.0.0 branch is NOT vulnerable OpenSSL 0.9.8 branch is NOT vulnerable According to the Security Enhancements in Android 4.2 article, Android started using OpenSSL 1.0.1 as of version 4.2. This means that older Android ...


1

The GMail application is now a general email application. You can set it up to talk to any email account. There are two important cases: You use the GMail application with a GMail account, for example: my.user.name@gmail.com. In this case, Google only allows secure connections. You access a non-GMail account using the GMail application. This may be ...


1

I could now install the certificate. I had to disable pattern screen lock and try installing certificate again. This time it asked me to setup security - pin or password. That I did and cert got installed. Got the solution from android central forum. http://forums.androidcentral.com/google-nexus-7-tablet-2012/301151-credential-storage.html I guess that ...


1

The certificate has most likely been added to your "trusted certificates". You can delete it in Settings › Security › Trusted Certificates then (Settings referring to the Android System Settings, not those of the browser used): chosing the "User" tab should display certificates you've added as user (as opposed to those the system already brings along, or you ...


1

You can install a CA certificate very easily through Settings. Just go to Security->Install from SD and choose your certificate. It will be installed to your device's certificate store/secured storage and should be used automatically by all applications that rely on that certificate store (which should be like every app that connects to the internet using ...


1

Use Drony. You change type in settings from default http to https. Be careful about HTTPS proxy certificate. If it's self signed there is option to trust all certs in settings. But then you can have mitm so it's not very secure. There is nice blog about setting up whole configuration. http://blog.habets.pp.se/2014/09/Secure-browser-to-proxy-communication---...


1

As you say that the problem exists only on 3G and not on WiFi, this is probably because of some problem with the Access Point of the your network provider. I faced a similar issue sometime back which was because the default access point had a proxy which didn't allow SSL Tunneling. After removing the Port and Proxy from the access point, this problem got ...


1

The link in other answer is expired. Built my own, for various archs: https://vi-server.org/pub/openssl_1.1.1_android_static_arm https://vi-server.org/pub/openssl_1.1.1_android_static_aarch64 https://vi-server.org/pub/openssl_1.1.1_android_static_x86 https://vi-server.org/pub/openssl_1.1.1_android_static_x86_64 "static" here does not mean actually static, ...


1

I ran into the same issue. First - make sure you have it all set up correctly on Fiddler on your PC: Goto Tools-->Fiddler Options-->HTTPS and make sure the first 3 check boxes are checked. Click "Export Root Certificate to Desktop" and copy the cert file from your desktop to your device/SD card In your device, goto setting-> security -> Credential Storage-...


Only top voted, non community-wiki answers of a minimum length are eligible