4 ms·
> By default, all modern Android apps only trust CA system certificates, and on a normal device you cannot change those. Sure you can. It's in a settings pane,
by mirashii 5y ago
> By default, all modern Android apps only trust CA system certificates, and on a normal device you cannot change those.
Sure you can. It's in a settings pane, Settings -> Security -> Encryption and Credentials -> Install a certificate.
MDM profiles can also install certificates.
There's pretty much zero possibility of this being removed as a feature as it is essential to a wide variety of corporate environments.
- mumphster 5y agoThis doesn’t bypass cert pinning in apps which was the original question
- pimterry 5y agoThose certificates are user-added certificates, not system certificates. Android has two separate certificate stores, the UI only exposes the user certificate store, and by default apps only trust the system certificate store. This was changed back in 2016, the original announcement post has some good details: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to... Enterprises can add certificates to the system store I believe, but only as part of the initial provisioning of the device, and only for enterprise-managed devices.
- GekkePrutser 5y agoIndeed, and such enterprise-management devices must be wiped for enrolment. There's some management modes which don't require that but they don't offer the ability to install system certs.