--- title: "Install System CA on Android" menu: howto: weight: 4 --- # Install System CA Certificate on Android Emulator [Since Android 7, apps ignore user certificates](https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html), unless they are configured to use them. As most applications do not explicitly opt in to use user certificates, we need to place our mitmproxy CA certificate in the system certificate store, in order to avid having to patch each application, which we want to monitor. Please note, that apps can decide to ignore the system certificate store and maintain their own CA certificates. In this case you have to patch the application. ## 1. Prerequisites - Emulator from Android SDK with proxy settings pointing to mitmproxy - Mitmproxy CA certificate - Usually located in `~/.mitmproxy/mitmproxy-ca-cert.cer` - If the folder is empty or does not exist, run `mitmproxy` in order to generate the certificates ## 2. Rename certificate Enter your certificate folder {{< highlight bash >}} cd ~/.mitmproxy/ {{< / highlight >}} - CA Certificates in Android are stored by the name of their hash, with a '0' as extension - Now generate the hash of your certificate {{< highlight bash >}} openssl x509 -inform PEM -subject_hash_old -in mitmproxy-ca-cert.cer | head -1 {{< / highlight >}} Lets assume, the output is `c8450d0d` We can now copy `mitmproxy-ca-cert.cer` to `c8450d0d.0` and our system certificate is ready to use {{< highlight bash >}} cp mitmproxy-ca-cert.cer c8450d0d.0 {{< / highlight >}} ## 3. Insert certificate into system certificate store Note, that Android 9 (API LEVEL 28) was used to test the following steps and that the `emulator` executable is located in the Android SDK - Start your android emulator. - Get a list of your AVDs with `emulator -list-avds` - Make sure to use the `-writable-system` option. Otherwise it will not be possible to write to `/system` - Keep in mind, that the **emulator will load a clean system image when starting without `-writable-system` option**. - This means you always have to start the emulator with `-writable-system` option in order to use your certificate {{< highlight bash >}} emulator -avd -writable-system {{< / highlight >}} - Restart adb as root {{< highlight bash >}} adb root {{< / highlight >}} - Get write access to `/system` on the device - In earlier versions (API LEVEL < 28) of Android you have to use `adb shell "mount -o rw,remount /system"` {{< highlight bash >}} adb shell "mount -o rw,remount /" {{< / highlight >}} - Push your certificate to the system certificate store and set file permissions {{< highlight bash >}} adb push c8450d0d.0 /system/etc/security/cacerts adb shell "chmod 664 /system/etc/security/cacerts/c8450d0d.0" {{< / highlight >}} ## 4. Reboot device and enjoy decrypted TLS traffic - Reboot your device. - You CA certificate should now be system trusted {{< highlight bash >}} adb reboot {{< / highlight >}} **Remember**: You **always** have to start the emulator using the `-writable-system` option in order to use your certificateange'>range
path: root/target/linux/ar71xx/files/arch/mips/ath79/mach-dir-600-a1.c
blob: 5e6134de7aa74f1862ae6c7561048fdb776621f9 (plain) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162