我创建了自己的 CA 证书，现在我想将它安装在我的 Android Froyo 设备 (HTC Desire Z) 上，以便设备信任我的证书。

Android 将 CA 证书存储在 /system/etc/security/cacerts.bks 的 Java keystore 中。我将文件复制到我的计算机，使用 portecle 1.5 添加了我的证书并将其推回设备。

现在，Android 似乎不会自动重新加载文件。我已经阅读了几篇我需要重新启动设备的博客文章。这样做会导致文件再次被原始文件覆盖。

我的下一个尝试是通过复制 SD 卡并使用设置菜单中的相应选项来安装证书。该设备告诉我证书已安装，但显然它不信任该证书。此外，当我尝试将 keystore 复制到我的计算机时，我仍然找到原始库存 cacerts.bks。

那么，在 Android 2.2 设备上安装我自己的根 CA 证书作为可信证书的正确方法是什么？有没有办法以编程方式做到这一点？

最佳答案

在 Android KitKat 之前，您必须 root 设备才能安装新证书。

从 Android KitKat (4.0) 到 Marshmallow (6.0)，一切皆有可能且简单。我能够在我的没有开启Root的设备上安装 Charles Web 调试代理证书并成功嗅探 SSL 流量。

摘自 http://wiki.cacert.org/FAQ/ImportRootCert

Before Android version 4.0, with Android version Gingerbread & Froyo, there was a single read-only file ( /system/etc/security/cacerts.bks ) containing the trust store with all the CA ('system') certificates trusted by default on Android. Both system apps and all applications developed with the Android SDK use this. Use these instructions on installing CAcert certificates on Android Gingerbread, Froyo, ...

Starting from Android 4.0 (Android ICS/'Ice Cream Sandwich', Android 4.3 'Jelly Bean' & Android 4.4 'KitKat'), system trusted certificates are on the (read-only) system partition in the folder '/system/etc/security/' as individual files. However, users can now easily add their own 'user' certificates which will be stored in '/data/misc/keychain/certs-added'.

System-installed certificates can be managed on the Android device in the Settings -> Security -> Certificates -> 'System'-section, whereas the user trusted certificates are manged in the 'User'-section there. When using user trusted certificates, Android will force the user of the Android device to implement additional safety measures: the use of a PIN-code, a pattern-lock or a password to unlock the device are mandatory when user-supplied certificates are used.

Installing CAcert certificates as 'user trusted'-certificates is very easy. Installing new certificates as 'system trusted'-certificates requires more work (and requires root access), but it has the advantage of avoiding the Android lockscreen requirement.

从 Android N (7.0) 起变得更难了，请参阅 Charles proxy website 中的这段摘录:

As of Android N, you need to add configuration to your app in order to have it trust the SSL certificates generated by Charles SSL Proxying. This means that you can only use SSL Proxying with apps that you control.

In order to configure your app to trust Charles, you need to add a Network Security Configuration File to your app. This file can override the system default, enabling your app to trust user installed CA certificates (e.g. the Charles Root Certificate). You can specify that this only applies in debug builds of your application, so that production builds use the default trust profile.

将文件 res/xml/network_security_config.xml 添加到您的应用中:

<network-security-config>    
    <debug-overrides> 
        <trust-anchors> 
            <!-- Trust user added CAs while debuggable only -->
            <certificates src="user" /> 
        </trust-anchors>    
    </debug-overrides>  
</network-security-config>

然后在你的应用 list 中添加对这个文件的引用，如下:

<?xml version="1.0" encoding="utf-8"?> 
<manifest>
    <application android:networkSecurityConfig="@xml/network_security_config">
    </application> 
</manifest>

关于android - 如何在 Android 设备上安装受信任的 CA 证书？，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/4461360/