Does there exist some standard API that allow an Android malware to download and install a SSL/TLS certificate as RCA, in the default keystore, in non-root devices?

I think that this is a very underestimated problem.

1 Answer 1


Any app can create a new KeyStore and do arbitrary things with it. So it is possible for a malware to import a downloaded root CA and use it for TLS connections originating from the malware itself.

This does, however, not impact any other app, as global KeyStores are not affected. To change it using official APIs, one needs to create an install intent via createInstallIntent, which can then be used to bring the certificate installation dialog up. Unless the user confirms the dialog, the certificate will not be installed.

Note that this answer does not consider exploits or other means outside of regular APIs to gain write access to global KeyStores, as your question explicitly asks for standard API only. An app with root access can of course use other means to change the list of root CAs.

  • Do you know if a standard API to list or simply count all the installed root or user certificates in the global keystore exists?
    – VanDir
    Oct 6, 2015 at 22:45
  • 1
    @VanDir For root CAs: I'm not sure if intermediate CA's are returned by X509TrustManager. getAcceptedIssuers() as well, but that might be a starting point. From a short search, this overview article about KeyChains in general describes the overall API ideas, so it might be helpful as well.
    – dst
    Oct 7, 2015 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .