Are mobile network providers able to store their own SSL certificate on SIM cards, and auto-import this certificate into trust store on mobile phones (Android/iOS)?

I know that SIM cards can store some data and execute some code. So does some API (maybe private API) for SIM cards on mobile OS exist, that can be used to install certificate?

  • What makes you think they are? – FMaz Feb 13 '17 at 13:42
  • @krazor nothing special, just theoretical question – g4s8 Feb 13 '17 at 13:51
  • I would reword your question towards a more specific scenario, for example something along the lines of "How can I read the contents of a SIM card" might yield better answers. As it stands right now you are asking if a provider 'is able to store a file in a SIM card' and if phones automatically read and act based on this file – Purefan Feb 13 '17 at 13:53
  • 1
    So...they can store arbitrary extra data on SIM card, but they can't manipulate with it without external interference. That is, SIM card cannot ask the device to do something, because it outside of standard SIM communication protocol. – Crypt32 Feb 13 '17 at 15:16
  • 1
    There is no current API to do this, however a SIM is like any other smartcard (often a Javacard) and can have multiple "applications" on it - the device selects which one to use with the SELECT command. So the mobile side would keep using the SIM application while the OS could be extended to expose the SIM card reader to userspace and apps can then try and use other SIM apps like the PKI app (for certificates). – André Borie Feb 16 '17 at 10:55