Develop Reference

Can't install CA certificate on Android 11

On preview version of Android 11 I got an error when trying to install CA certificate:
Intent intent = new Intent("android.credentials.INSTALL");
intent.putExtra("name", getCertName());
intent.putExtra("CERT", getCert());
startActivity(intent);
The error message is:
Can't install CA certificates
CA certificates can put your privacy at risk and must be installed in
Settings.
I haven't found nothing on Android documentation about this change. Any ideas? Any workarounds (except to install it manually from settings)?
UPDATE (28/4):
Found a bug in issuetracker: https://issuetracker.google.com/issues/151858120

I have also face same issue.
Please follow below steps in android 11 or 11+.
In Android 11, to install a CA certificate, users need to manually:
Open Device settings
Go to 'Security'
Go to 'Encryption & Credentials'
Go to 'Install from storage' or 'Install a certificate' (depend on devices)
Select 'CA Certificate' from the list of types available
Accept a warning alert.
Browse to the certificate file on the device and open it
Confirm the certificate install
On "modern" Samsung phones
it's hidden in Settings -> Biometrics and security -> Other security settings -> Install from device storage -> CA Certificate -> Install Anyway

There's a tiny note about this in the Android 11 enterprise changelog here, which says:
Note: Apps installed on unmanaged devices or in a device's personal profile can no longer install CA certificates using createInstallIntent(). Instead, users must manually install CA certificates in Settings.
Sounds very much like this is intentional, and you won't be able to get around it on normal unmanaged devices. You'll either need to look into full Android device management, or provide instructions to your users on doing manual setup instead.
Note that registering your app as a normal device admin app is not sufficient either. To use the remaining DevicePolicyManager.installCaCert API your app must be the owner of the device or profile.
That means from Android 11+, you can do automatic setup for CA certs used only within separate & isolated work profiles on the device, or for fresh devices that you provision with your app pre-installed, and nothing else.
If you'd like this behaviour changed, there's an issue you can star & comment on in the Android tracker here: https://issuetracker.google.com/issues/168169729

Use mkcert certificate for local testing of PWA

I'm trying to setup a local dev environment for a PWA I'm working on.
I have installed mkcert on my Mac and am able to host a https://localhost version on my computer.
Now I'd like to open the page on my Android phone. On the mkcert github it says:
Mobile devices
For the certificates to be trusted on mobile devices,
you will have to install the root CA. It's the rootCA.pem file in the
folder printed by mkcert -CAROOT.
On iOS, you can either use AirDrop, email the CA to yourself, or serve
it from an HTTP server. After installing it, you must enable full
trust in it. Note: earlier versions of mkcert ran into an iOS bug, if
you can't see the root in "Certificate Trust Settings" you might have
to update mkcert and regenerate the root.
For Android, you will have to install the CA and then enable user
roots in the development build of your app. See this StackOverflow
answer.
https://github.com/FiloSottile/mkcert
I installed the rootCA.pem on my phone. The part about "enabling user roots" doesn't apply, since this is not an app.
But when I open the page on my phone using https://[my-local-network-ip]:1234 I get a warning, that the certificate can't be trusted.
How can I trust the certificate so I can locally test the PWA on my phone?

I know you've probably moved on from this question, as it's almost a year on. However, I would like to share how I was able to test my PWA locally in a secure context.
Not making any assumptions about what framework / packaging / build system you're using:
Generate a certificate & key using mkcert. If you are hosting your PWA locally & want to access it over your local IP address i.e. 192.168.1.x:3000 you also need to tell mkcert to generate a certificate that covers that IP address:
mkcert localhost 192.168.1.17
// The certificate is at "./localhost+1.pem" and the key at "./localhost+1-key.pem" ✅
Important note: most routers dynamically assign local IP addresses, so it's worthwhile assigning a static IP.
Install your RootCA from mkcert onto your iOS or Android device. Follow the instructions in the mkcert docs
Serve your generated certificates with your web server of choice. I use Create React App. You can see my answer about PWAs in secure context here

I agree with your goal - running a local TLS based setup can be useful in terms of productivity and early troubleshooting.
Your problem is DNS based and you need to access the TLS secured URL via the host name.
The only way you'll get DNS to match up on the Android side is to use an HTTP proxy, while running either an emulator or a device connected via USB.
In a nutshell I would do this:
Issue your cert to a more real world domain name such as mycompany.com
Add this domain name to DNS on your Mac book
Install a free proxy such as proxyman on the Mac
Configure the Android emulator or device to use the proxy (you will also need to trust the proxy's cert on Android and the Mac)
Then browse to https://mycompany.com from Android
Full details are available in my write up

Charles ssl certificate download failed "due to network failures"

The Charles SSL/HTTPS proxying was working fine on my Samsung Galaxy S5 phone.
I remove the certificate while not debugging because the phone warns me about the connection being monitored by a third party.
Now when I attempt to re-download the certificate from http://www.charlesproxy.com/getssl/ I get a charles-proxy-ssl-proxying-certificate.pem download failed due to network failures error:
The phone is set up to use the Charles proxy. HTTP traffic can be inspected in Charles.
I'm running Charles 3.11.4 but I've also tested with 3.11.2. The phone is running Android 5.0
I tested with an LG Nexus 5 and the certificate downloaded and installed without any problems.

As a workaround, type this into your address bar and press Go.
data:text/html,<a href=http://www.charlesproxy.com/getssl/>Save This Link
Long-press on the link that appears and choose Save Link. Then open the certificate you downloaded.

It's Chrome Mobile - try a different browser, Dolphin worked fine.
Yet another thing Google broke in Chrome Mobile.

I manually worked around this issue by:
Exporting the Charles certificate (Help > SSL Proxying > Export Charles Root Certificate and Private Key...) and setting a suitable password
Copying the certificate to Google Drive
Disabling the Manual Proxy setting on the Android device
On the Android device going to Settings > Security > Install from storage
Selecting the Google Drive account containing the certificate
Selecting the certificate file and entering the password
Selecting "VPN and Apps" for "Credential use"
The certificate was then loaded into the system-wide User credential storage and I was able to successfully SSL proxy the app I'm currently working on.

I did it very simply.
Go to URL http://charlesproxy.com/getssl/
In Charles, you should see a response from the server with the certificate.
Like in this screen:
http://i.stack.imgur.com/pe3z7.png
Copy this text in txt file, and save it like *.cer
Attach *.cer to email, and send it to a device.
On your phone, you should click on the attached file and install the certificate.
Profit!)

I was also getting charles-ssl-certificate-download-failed-due-to-network-failures error. I had updated charles to version 3.11.5 and then installed charles certificate on my mobile device.
It worked like a charm. I guess either in earlier version my browser was not configured to use charles proxy. Or there might be some issue in previous charles version.
Hope it helps :)

After a lot of struggle and swears, I found the problem that was going on with my Charles. I was getting network errors/failures due to long connections
It seems this was a problem from the additional connections created from my virtual machines. For anyone still stuck on this, to solve, instead of setting the IP in the Help-SSL Proxying-Install charles root ceritificate on a mobile device or remote browser, set your actual IP from windows. To get this, navigate to Network and Sharing centre - click on your current connection - Details - and then use the IP under IPv4 Address. Then use the HTTP port as configured in Charles.

It works to me by exporting SSL certificate to a file and copy this file to mobile device. Then install it from phone.
Check this post:
http://go4test.blogspot.ca/2016/10/charles-proxy-failed-due-to-network.html

similar as Evgeniy Melnikov suggested.
Exporting the Charles certificate (Help > SSL Proxying > Export Charles Root Certificate and Private Key...) and setting a suitable password
from where the cert is saved at #1, attach to an email and send to an account which is accessible from the mobile.
in the mobile mail client download the attached cert file (to Downlaod folder).
in the mobile Setting > Security > install from storage, (or in some emulator Settings > Security > install from SD card) goto Downlaod folder and clicking on the downloaded cert file.
Selecting the certificate file and entering the password.
Selecting "VPN and Apps" for "Credential use"
after the cert is installed on the device, change the wifi settings to point to the machine the Charles in stalled and running.

How do I import a CA certificate into Android 4.4.2 in the emulator?

I tried both DER and PEM formats. I tried using the file extensions crt, cer, p12, pem but nothing of them get imported. I went into Settings > Security > Install from SD card and it takes me to the Downloads page. I have the certificates listed but when I click on them, nothing happens.
Updated to add: I ended up going back to 4.3. It works fine in that.

Go to Android Virtual Device Manager (sdk\tools\android.bat avd)
Start your emulator but select 'Wipe user Data' when you're starting the emulator
Copy your certificate into /storage/sdcard using e.g. sdk/tools/monitor.bat
Set a screenlock pin here: Settings > Security > Screenlock > PIN
Now you can import the certificate properly via Settings > Security > Install from storage
Background: I also had the same problem you described and it seems to be an android emulator 4.4.2 bug which occurs when you don't import the certificate first thing i.e. when you don't follow the exact steps above.

This question is old, but still persists. Hopefully this will help some other developers who still need to add a certificate to their emulator.
Download the certificate using any of the various methods. I emailed myself the certificate from my computer, turned on the emulator, ran gmail and downloaded the certificate to the emulator through gmail.
Depending on your settings, you may be prompted to accept the certificate as soon as its downloaded. Others may be able to find the certificate file using a files program where simply executing it will install the certificate.
But for those who can't, here's the sure-fire method.
Run the Settings app
Security
Encryption & Credentials
Install a Certificate
choose Selected CA Certificate
Install anyway
tap on the downloaded certificate
You should get a Toast saying that the CA certificate was installed.
This is for an emulator running Android R. Good luck!

With your limited description, I'll try to help as much as I can.
Ensure your problematic AVD (4.4 I assume) has available storage space. Try best to ensure it is a clean AVD with nothing extra installed.
Place your cert in the root /sdcard/ and install at:
Settings -> Security -> Install from SD card
Avoid installation of certs with the same name but different formats.

Problem with *.p12 files (pkcs12):
at: Settings -> Security -> Install from SD card the *.p12 files are grayed out. When I download the file via webserver and try to open it, android say me "Can't open" Same with *.pem files.
I tried it with 4.4.2 and 4.4.4.

There is a script available at https://github.com/mitmproxy/mitmproxy/issues/204#issuecomment-32837093.

Charles proxy fails on SSL Connect Method

I have Android 4.3 forced to use Charles proxy via IPTABLES.
The charles certificate is installed on the phone.
I am able to capture normal SSL traffic like https websites in the browser.
All POST and GET methods seem to work fine.
In a particular app, it fails when using the SSL CONNECT method.
URL: https://XX.XX.XXX.XXX/
Status: Failed
Failure: SSLHandshake: Received fatal alert: unknown_ca
Response Code: - Protocol: HTTP/1.0
Method: CONNECT

From iOS 10.3 you also need to go to Settings > General > About > Certificate Trust Settings and trust Charles certificate.

You can face with this problem at some applications like Facebook or Instagram.
Charles certificate doesn't work at some new apps because they are using a technique named as SSL-PINNING. First of all you have to break ssl-pinning system of application or you can instal old version of application then it sometimes works but we need a new solution about ssl pinning in order to record traffic for this kind of applications.

as #Berkay Yıldız says, it probably using ssl/certificate pinning.
how to fix/avoid/disable ssl pinning?
the whole logic is:
LEVEL 1: for normal http：
core logic：
PC：Mac/Windows
Charles set http proxy
set port
app use Charles proxy
inside Wifi, set
host IP
port
Note：
computer side, MUST use wired network, NOT wireless, otherwise mobile side network not usable
LEVEL 2: for encrypted https：
PC
install Charles root certificate
Mac：use Key Chain to trust Charles Root CA
Charles
Enable SSL Proxying
set location filter for your specific api address
phone
app
install Charles Root CA
Note: type should select: VPN and Application
NOT select：WLAN
makesure certificate install successfully
Trusted Credentials -> User, can see installed Charles certificate
LEVEL 3: for SPECIAL https which using ssl pinning:
Phone：
make sure root or jailbreak
Android：has rooted
for later to install tool: Xposed
iOS：has jail break
for later to install tool: Cydia
then install plugin/tool, capable of avoid/disable ssl pinning
Android：
JustTrustMe (based on Xposed)
Android-SSL-TrustKiller (Cydia Substrate)
iOS：
SSL Kill Switch 2 (based on Cydia)
old version：iOS SSL Kill Switch (based on Cydia)
more detailed summary please refer my post (written in Chinese): 1 and 2

Some folks my end up here with android N Devices that won't do SSL over charles even after installing the cert - now on http://chls.pro/ssl
In N - you need to also add an xml file and security config. This post goes into more details: How to get charles proxy work with Android 7 nougat?

I have met the same problem. And after installing the latest certificate, it is solved.

On your phone, visit http://charlesproxy.com/getssl to download the cert. Upon downloading the cert in android, it will prompt you to install the cert, give the cert a name and continue. It should now work.
Note: The sshould be similar on an iPhone

I got the following error when I was trying to install the cert on my Nexus 6p, Android 6.0. (I followed the instructions in charles and downloaded the cert via http://chls.pro/ssl.):
Couldn't install because the certificate file couldn't be read.
The solution to this problem was to install via:
Settings > Security > Install from storage
After navigating to the cert file and installing it everything worked as expected.

On this link http://www.charlesproxy.com/documentation/using-charles/ssl-certificates/ you have all the information you need on properly installing the Charles certificate.
After installing it you'll get rid of the "SSLHandshake: Received fatal alert: unknown_ca" error.

If you get this with an app using facebook login on an android phone, I got around it by uninstalling the fb app. Then the mobile fb web is used instead and I can charles everything. With the fb app installed the fb api fails with SSL error.

On Samsung phones, you should install the certificate by navigating to Biometrics and security/Other security settings/Install from device storage/CA Certificate.

I am using Charles 4.2.5 and Nexus 6P on Android 8.1.
One cannot use Charles to track https on my mobile phone.
Plz note that after Android N, we cannot capture normal SSL traffic of others'app.
Here is the official website of Charles.
https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/
Android As of Android N, you need to add configuration to your app in
order to have it trust the SSL certificates generated by Charles SSL
Proxying. This means that you can only use SSL Proxying with apps that
you control.
In order to configure your app to trust Charles, you need to add a
Network Security Configuration File to your app. This file can
override the system default, enabling your app to trust user installed
CA certificates (e.g. the Charles Root Certificate). You can specify
that this only applies in debug builds of your application, so that
production builds use the default trust profile.
Add a file res/xml/network_security_config.xml to your app:
Then add a reference to this file in your app's manifest, as follows:
...