Hot answers tagged

19

I had the same problem getting Android to really install the certificate, until I found this site which describes a method that worked for me. It boils down to the following steps: Create a private key and public x509 certificate with v3_req extensions and enabled as a CA: sudo openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /etc/ssl/private/...


5

Assuming you are not doing Android development, you do not need to worry about Android version. Any serious security-minded application like Chrome on Android will use TLS 1.2. You can verify this for yourself by going to a secure website (make sure it supports TLS 1.2!) and inspecting the certificate and protocol used on the client. I have checked this on ...


5

If you control the network, you can use Shark for Root to check whether the apps open port 80 (default port for HTTP) or port 443 (default port for HTTPS). IIRC, WireShark can also read HTTP headers. If you don't want to root your phone, and you're on a Wifi network that you owned; you can use Wireshark/Firesheep to snoop on the traffic of the Android ...


4

HTTP error 500 indicates a server problem. You should report the problem to the owner of the website so they can fix it. Some sites deliberately behave differently for different browsers and OSes, so that could be triggering the problem at the server. There's one more possibility, if you're using mobile data (instead of Wi-Fi) to access the site. Most ...


4

Firefox 47 can be installed on the 1st generation Kindle Fire. It supports TLS 1.2. Download link: Mozilla's official FTP.


3

This question is a near duplicate of questions like this and this, and closely related to this and this. In fact it can be better explained by a developer, but since it keeps on appearing again and again with slightly different situations, I'll try to explain what I know with some unnecessary details to make the picture clear from a broader perspective. In ...


3

Android devices are only susceptible to this bug if they connect to servers which have not updated their server-side OpenSSL components. If the server component of OpenSSL is secure, no data is leaked. Therefore the main focus of this vulnerability is to server admins, not individual users. Most probably this can be fixed with app updates as a temporary fix,...


3

Just faced with exactly the same problem. I googled for an answer but this is page the only case I found. Solution is simple for rooted device: Open and file explorer with root-access (I prefer ES file explorer) Go to /data/misc/keystore/usesr_0 and find there the cert and key files. Transfer it securely to your desktop. If you have a non-rooted device ...


2

Go to Settings > Security > Credential storage > Install from SD card. If it's not there you may need a newer Android version or a workaround which I don't know about.


2

From StackOverflow: How to install trusted CA certificate on Android device? I spent a lot of time trying to find an answer to this (I need Android to see StartSSL certificates). Conclusion: Android 2.1 and 2.2 allow you to import certificates, but only for use with WiFi and VPN. There is no user interface for updating the list of trusted root certificates, ...


2

I don't think there is a way to find out directly. The only thing I can think of is Check the log files and hope there is a mention of https, however this is not likely to be very succesful. Reverse engineer the app and look at the source code but to understand what your looking for you'll want to have some Android programming experience.


1

SSL/TLS support is based on the Android version. There's no way for Android end-users to fix this issue unless to upgrade to a newer Android version if possible. In this case, based on Qualys SSL Server Test, the site only supports TLS 1.2. TLS 1.2 is only supported since Android 4.4.2 KitKat, where Android 4.3 Jelly Bean and before only supports TLS 1.0 (...


1

As tipped by @beeshyams, HttpCanary is perfect for this. You need a rooted device, of course. HttpCanary takes care of all of the difficult steps (certificate generation and installation) transparently. It shows a list of requests (filterable by app), and details of each request and response. The best feature is this overlay showing request while I am using ...


1

A certificate authority signs digital certificates. Often times companies will pay an internationally trusted CA such as VeriSign or DigiCert to sign certificates on their own domain. In some cases it may make more sense to act as your own CA, rather than paying a CA like DigiCert. Your university is doing exactly that, ie using their own certificate ...


1

From the article you posted: OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable OpenSSL 1.0.1g is NOT vulnerable OpenSSL 1.0.0 branch is NOT vulnerable OpenSSL 0.9.8 branch is NOT vulnerable According to the Security Enhancements in Android 4.2 article, Android started using OpenSSL 1.0.1 as of version 4.2. This means that older Android ...


1

The GMail application is now a general email application. You can set it up to talk to any email account. There are two important cases: You use the GMail application with a GMail account, for example: my.user.name@gmail.com. In this case, Google only allows secure connections. You access a non-GMail account using the GMail application. This may be ...


1

I could now install the certificate. I had to disable pattern screen lock and try installing certificate again. This time it asked me to setup security - pin or password. That I did and cert got installed. Got the solution from android central forum. http://forums.androidcentral.com/google-nexus-7-tablet-2012/301151-credential-storage.html I guess that ...


1

The certificate has most likely been added to your "trusted certificates". You can delete it in Settings › Security › Trusted Certificates then (Settings referring to the Android System Settings, not those of the browser used): chosing the "User" tab should display certificates you've added as user (as opposed to those the system already brings along, or you ...


1

You can install a CA certificate very easily through Settings. Just go to Security->Install from SD and choose your certificate. It will be installed to your device's certificate store/secured storage and should be used automatically by all applications that rely on that certificate store (which should be like every app that connects to the internet using ...


1

Use Drony. You change type in settings from default http to https. Be careful about HTTPS proxy certificate. If it's self signed there is option to trust all certs in settings. But then you can have mitm so it's not very secure. There is nice blog about setting up whole configuration. http://blog.habets.pp.se/2014/09/Secure-browser-to-proxy-communication---...


1

As you say that the problem exists only on 3G and not on WiFi, this is probably because of some problem with the Access Point of the your network provider. I faced a similar issue sometime back which was because the default access point had a proxy which didn't allow SSL Tunneling. After removing the Port and Proxy from the access point, this problem got ...


1

The link in other answer is expired. Built my own, for various archs: https://vi-server.org/pub/openssl_1.1.1_android_static_arm https://vi-server.org/pub/openssl_1.1.1_android_static_aarch64 https://vi-server.org/pub/openssl_1.1.1_android_static_x86 https://vi-server.org/pub/openssl_1.1.1_android_static_x86_64 "static" here does not mean actually static, ...


1

Your best bet will be to build it from source. There are a few StackOverflow questions that you might want to reference if you haven't already. How to use openSSL Library in the ANDROID application How to build OpenSSL on Android/Linux ? Openssl Build Issue with Android NDK r8 The first SO has an answer linking to a GitHub project android-external-...


1

I ran into the same issue. First - make sure you have it all set up correctly on Fiddler on your PC: Goto Tools-->Fiddler Options-->HTTPS and make sure the first 3 check boxes are checked. Click "Export Root Certificate to Desktop" and copy the cert file from your desktop to your device/SD card In your device, goto setting-> security -> Credential Storage-...


1

We had similar issues in our office router which had expired security certificate resulting in denial of HTTPS URLs. When we updated our certificate this issue was solved. I guess your issue should be similar. I stumbled on a web page that claims the solution. But looking at the solution I very much doubt its worth.


Only top voted, non community-wiki answers of a minimum length are eligible