My company uses a private PKI to handle such scenarios such as
- Mutual auth (TLS) to a website using client certificates
- SSL web server certificates on an Intranet (once a VPN session is established.)
- S/MIME secure email.
- Activesync authentication
When upgrading Android to Kitkat the presence of a non-default root certificate results in these warnings
It is possible to remove this warning for a root user, or by uploading the certificate into Google Apps (and paying $5 per user/month), however I'm looking for a solution that does not incur this unnecessary cost.
Several people have posted this as a defect in the FOSS code, however the issue #62076 (starred by 121 people) has been closed as "by design". Edit: This issue has been reopened in issue 82036 Please star it to vote as an issue, or comment as needed.
Through testing I verified that this error still appears when using Name Constraints, and limiting the EKU purpose of the new Root CA. (S/MIME, client authentication, etc).
Is there any way to add a certificate to the trusted roots on an Android phone that does not create this error? (in current or future version)
Are non-default trusted roots, in practice, more problematic than the default CA list (in other words is Google solving the wrong problem?)
Is it reasonable to allow a root cert that is properly constrained (at the root) by EKU usages, or Name Constraints to generate a different warning or set of approval dialogs?