how to install CA certificate programmatically on Android without user interaction

android android-intent x509certificate android-wifi
Pedro picture Pedro · Jul 25, 2012 · Viewed 22.5k times · Source

I'm trying to install certificates without prompting the user. I know this is not good practice, but that's what PM wants.

Using KeyChain.createInstallIntent(), I can get Android to launch the certificate installation dialog by calling startActivity. However, when I pass the intent to sendBroadcast, nothing happens. Maybe the platform doesn't support this for security reasons?

String CERT_FILE = Environment.getExternalStorageDirectory() + "/test/IAT.crt";
Intent intent = KeyChain.createInstallIntent();
try {
    FileInputStream certIs = new FileInputStream(CERT_FILE);
    byte [] cert = new byte[(int)certFile.length()];
    certIs.read(cert);
    X509Certificate x509 = X509Certificate.getInstance(cert);
    intent.putExtra(KeyChain.EXTRA_CERTIFICATE, x509.getEncoded()); 
    intent.putExtra(KeyChain.EXTRA_NAME, "IAT Cert");
    EapActivity.this.startActivityForResult(intent, 0);  // this works but shows UI
    EapActivity.this.sendBroadcast(intent);  // this doesn't install cert
} catch (IOException e) {

Answer

Nikolay Elenkov picture Nikolay Elenkov · Jul 26, 2012

You can only install certificates silently if you have system privileges. Showing up a confirmation dialog is intentional, since trusting certificates can have serious consequences -- Android could happily open phishing sites without a warning, etc. That said, the dialog in ICS/JB is pretty bad -- it doesn't tell you what certificate you are installing and who issued it, just that it's a CA certificate, which is kind of obvious.

So, either use the public KeyChain API and use startActivity() to get the confirmation dialog, or pre-provision devices before handling them to users.

Update: In Android 4.4, DevicePolicyManager has a hidden API (installCaCert) that allows you to install certificates silently. You need the MANAGE_CA_CERTIFICATES permission, which is signature|system, so still not doable for user-installed apps.

Related questions

How do I pass data between Activities in Android application?

I have a scenario where, after logging in through a login page, there will be a sign-out button on each activity. On clicking sign-out, I will be passing the session id of the signed in user to sign-out. Can anyone …

Read More
How can I open a URL in Android's web browser from my application?

How to open an URL from code in the built-in web browser rather than within my application? I tried this: try { Intent myIntent = new Intent(Intent.ACTION_VIEW, Uri.parse(download_link)); startActivity(myIntent); } catch (ActivityNotFoundException e) { Toast.makeText(this, "…

Read More
How do I get extra data from intent on Android?

How can I send data from one activity (intent) to another? I use this code to send data: Intent i=new Intent(context,SendMessage.class); i.putExtra("id", user.getUserAccountId()+""); i.putExtra("name", user.getUserFullName()); context.startActivity(i);

Read More