I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ProxyDroid set up, that transparently routes all web-seeking traffic through the ZAP proxy I've set up.

Browsing https sites via chrome on android, and accepting the ZAP certificate on the red warning page works well, and gives me un-encrypted sessions on ZAP. However, any other apps that communicate via ssl/https simply refuse to send any network traffic.

I would like to know how I can set up a 'universal' trusted CA certificate on my android device, that allows me to see the un-encrypted traffic on ZAP. My android device is rooted.

Let me know if the information I've provided is incomplete or not clear.


  • Apps might have hardcoded certificates or thumbprints and only communicate with a server that has exactly the expected certificate. If an app works that way, the only way to get it to run with your certificate would be reverse-engineering and modifying it. – Flo Jul 15 '13 at 8:49
  • That is true, but I'd like to test for an easier case where apps are using certificates presented by the OS, before making assumptions about hardcoded certificates and thumbprints. – Hammad Akhwand Jul 15 '13 at 9:42
  • 3
    You could try installing the CA cert you created onto the device. Settings> Security> Trusted Credentials. There is a system store of trustede CAs that is created when the roms are built but you can upload user certs in p12 format which would include the ca cert. hope that helps some. – dudebrobro Jul 15 '13 at 13:07
  • 1
    @QuentinSwain has the right idea, but there technical obstacles to actually doing it in older Android systems (i.e., pre-4.0). See SO's How to install trusted CA certificate on Android device?, which links to an article that links to Android's bug tracker item "Provide support for managing CA and client certificates" which states it was added in ICS (4.0). Before 4.0, custom CAs were only used for VPN and Wifi, not websites or apps. (It may be possible on pre-4.0 with a rooted device.) – apsillers Jul 15 '13 at 13:20
  • 1
    @AJHenderson Sure, I just wanted to bring up the shortcomings of pre-4.0 custom CAs to save the OP some hair-pulling frustration, in case he was planning to use a pre-4.0 device for testing. – apsillers Jul 15 '13 at 13:56

You should be able to add a root certificate to the keystore in Android under the settings. Note that adding a certificate to the keystore will require a password or pattern lock to be turned on on the device. You can access the keystore under Settings/Security normally, though some customized versions of Android may have moved it a bit.

  • I did try adding a root CA certificate in my device (Jellybean 4.2.2) via settings > security > Install from storage. But the apps still refused to communicate with their servers. Should I explicitly be specifying the app servers for whose traffic I want visible on ZAP, so that ZAP presents my certificate for those servers instead of just forwarding the traffic? Would such a setting even exist in ZAP? – Hammad Akhwand Jul 16 '13 at 5:11
  • 1
    I don't know your particular proxy, but if it doesn't include the proper site name in the certificate, it is going to still error. That may be the problem. It is also possible the application is running off it's own trusted root certificate in which case you might not be able to do anything. – AJ Henderson Jul 16 '13 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.