1

I installed the CAcert root certificates on my Android device (which is not rooted), so that I could visit websites with server CAcert certificates without getting the "certificate not trusted" warning.

But now I get constantly reminded by Android, at each reboot, that a third party is capable of monitoring my network activity.

Android Network monitoring alert

How is it possible? Does it mean that even the "standard" trusted certs that come with Android are capable of such a thing too? How is it even possible?

Improve this question
2
  • I don't understand why the title mentions client certificates?
    – Jacques
    Jul 17, 2015 at 12:30
  • 1
    @Jacques Oops, you're right! What triggers the error on Android isn't the CAcert client certificate, but the CAcert root & intermediate certificates that I have to install in my system in order to make all the certs work. Good point!
    – Diti
    Jul 17, 2015 at 12:33

2 Answers 2

Reset to default
6

If you add a root certificate to your device, that cert could be used to sign SSL certificates for any domain.

That is, CAcert could — in theory — sign a cert for google.com, and your device would accept that as being valid (since you've added their root to your device).

That's not too different from any other root CA signing certificates they actually shouldn't sign, but the risk is certainly higher with a self-added "random" root CA like CAcert.

Improve this answer
1
  • That makes perfect sense! It's just a pity that I can't make these warnings go away without rooting my device.
    – Diti
    May 27, 2014 at 13:29
0

Android 5.2 and perhaps other 5.x versions should only prompt once on reboot. This should fix your issue.

I assume you're running 4.x or older.

Improve this answer
1
  • I am now using Android 5.x, however the warning is still an issue to me; I completely trust the certificates I installed in my userspace (CAcert and my own CA), I don’t need to be reminded at every reboot that my device is supposedly less secure!
    – Diti
    Jul 16, 2015 at 19:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .