Move a user CA cert to a trusted root cert in Android 13

Question

I am using Fiddler, and I have to insert a CA Cert to decrypt the SSL certificate coming out of my device. My device running Android 13 is rooted, and when I installed my cert, it went into the user's section (as expected).

However, I also tried to move the cert to my root certs folder (/system/etc/security/cacerts) and although I should have access, every time I move it, the cert does not show up.

Is there any good way to move a user CA cert to a trusted root cert? Thanks.

Answer 1

In modern Android, when you install a CA certificate manually through the UI, it's always installed as a user certificate. Officially it's not possible to modify the system certificates.

There are ways to get around this though - I've written a detail write-up of how Android HTTPS works generally and how to modify this using root here, and the details of some notable very recent related changes in Android 14 here.

In practice, for Android 13, the process should be:

• Copy the certificate into /system/etc/security/cacerts
  • Like every cert here, the filename should be it's certificate hash plus .0 (OpenSSL's subject_hash_old format, equivalent to this code)
  • This isn't writable by default - you'll need to either remount /system to make it writable, or use a tmpfs mount over this directory
• The cert needs to have 644 permissions and the system_file SELinux flag set
• Once that's done, it should appear in the system CA certificates in settings

If that doesn't work, check if you have a /apex/com.android.conscrypt/cacerts directory. If so, you have the Android 14 version of Conscrypt installed, and there's some extra steps. See the 2nd article above for full details, but in short: you need to use nsenter to add a bind mount for that /system/etc/security/cacerts path into the APEX path for every single running app process on the machine, including the Zygote/Zygote64 processes (which launch new processes in future, who will inherit this setting). That looks like this:

nsenter --mount=/proc/$PID/ns/mnt -- \
    /bin/mount --bind /system/etc/security/cacerts /apex/com.android.conscrypt/cacerts

Alternatively, if that's too fiddly to do manually, you can use HTTP Toolkit which is a modern version of Fiddler I've built, that does HTTPS interception too but automates all the setup down to one click. That's all open-source, so if you want to see the full details of how this works so you can automate it yourself just follow the code from here.

Answer 2

If you are using Magisk to root the device, the easiest way I have found so far is to install the following module:

https://github.com/NVISOsecurity/MagiskTrustUserCerts

1. Install the certificate as a user CA certificate.
2. Download the module zip file from Github releases.
3. Go to the modules tab in Magisk and select the zip from the filesystem.
4. Reboot as directed by the prompt.

The certificate should now be in system certificates if all has gone well.