blocks|key|1061871|text|如果您需要用于HTTPS连接的证书，您可以将.bks文件作为原始资源添加到您的应用程序中，并扩展DefaultHttpConnection，以便您的证书用于HTTPS连接。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1061872|public+class+MyHttpClient+extends+DefaultHttpClient+{

++++private+Resources+_resources;

++++public+MyHttpClient(Resources+resources)+{
++++++++_resources+=+resources;
++++}

++++@Override
++++protected+ClientConnectionManager+createClientConnectionManager()+{
++++++++SchemeRegistry+registry+=+new+SchemeRegistry();
++++++++registry.register(new+Scheme("http",+PlainSocketFactory
++++++++++++.getSocketFactory(),+80));
++++++++if+(_resources+!=+null)+{
++++++++++++registry.register(new+Scheme("https",+newSslSocketFactory(),+443));
++++++++}+else+{
++++++++++++registry.register(new+Scheme("https",+SSLSocketFactory
++++++++++++++++.getSocketFactory(),+443));
++++++++}
++++++++return+new+SingleClientConnManager(getParams(),+registry);
++++}

++++private+SSLSocketFactory+newSslSocketFactory()+{
++++++++try+{
++++++++++++KeyStore+trusted+=+KeyStore.getInstance("BKS");
++++++++++++InputStream+in+=+_resources.openRawResource(R.raw.mystore);
++++++++++++try+{
++++++++++++++++trusted.load(in,+"pwd".toCharArray());
++++++++++++}+finally+{
++++++++++++++++in.close();
++++++++++++}
++++++++++++return+new+SSLSocketFactory(trusted);
++++++++}+catch+(Exception+e)+{
++++++++++++throw+new+AssertionError(e);
++++++++}
++++}
}|code-block|syntax|javascript|1061873|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If you need your certificate for HTTPS connections you can add the .bks file as a raw resource to your application and extend DefaultHttpConnection so your certificates are used for HTTPS connections.

<pre><code>public class MyHttpClient extends DefaultHttpClient {

 private Resources _resources;

 public MyHttpClient(Resources resources) {
 _resources = resources;
 }

 @Override
 protected ClientConnectionManager createClientConnectionManager() {
 SchemeRegistry registry = new SchemeRegistry();
 registry.register(new Scheme("http", PlainSocketFactory
 .getSocketFactory(), 80));
 if (_resources != null) {
 registry.register(new Scheme("https", newSslSocketFactory(), 443));
 } else {
 registry.register(new Scheme("https", SSLSocketFactory
 .getSocketFactory(), 443));
 }
 return new SingleClientConnManager(getParams(), registry);
 }

 private SSLSocketFactory newSslSocketFactory() {
 try {
 KeyStore trusted = KeyStore.getInstance("BKS");
 InputStream in = _resources.openRawResource(R.raw.mystore);
 try {
 trusted.load(in, "pwd".toCharArray());
 } finally {
 in.close();
 }
 return new SSLSocketFactory(trusted);
 } catch (Exception e) {
 throw new AssertionError(e);
 }
 }
}
</code></pre>

blocks|key|1061925|text|我花了很多时间试图找到这个问题的答案(我需要安卓系统才能看到StartSSL证书)。结论:Android2.1和2.2允许您导入证书，但仅适用于WiFi和VPN。没有用于更新受信任根证书列表的用户界面，但有关于添加该功能的讨论。目前还不清楚是否有可靠的解决方法来手动更新和替换cacerts.bks文件。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1061926|详情和链接：http://www.mcbsys.com/techblog/2010/12/android-certificates/。在这篇文章中，请参阅Android+bug+11231的链接--您可能希望将您的投票和查询添加到该bug中。|offset|length|1061927|entityMap|0|LINK|mutability|MUTABLE|url|http://www.mcbsys.com/techblog/2010/12/android-certificates/^0|0|6|1O|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

I spent a lot of time trying to find an answer to this (I need Android to see StartSSL certificates). Conclusion: Android 2.1 and 2.2 allow you to import certificates, but only for use with WiFi and VPN. There is no user interface for updating the list of trusted root certificates, but there is discussion about adding that feature. It’s unclear whether there is a reliable workaround for manually updating and replacing the cacerts.bks file. 

Details and links: <a href="http://www.mcbsys.com/techblog/2010/12/android-certificates/" rel="noreferrer">http://www.mcbsys.com/techblog/2010/12/android-certificates/</a>. In that post, see the link to Android bug 11231--you might want to add your vote and query to that bug.

blocks|key|1061972|text|这里有一个替代解决方案，可以将您的证书添加到内置的默认证书列表中：Trusting+all+certificates+using+HttpClient+over+HTTPS|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1061973|但是，它只适用于您的应用程序。没有办法以编程方式为用户设备上的所有应用程序执行此操作，因为这会带来安全风险。|1061974|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https/6378872#6378872^0|X|1H|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

Here's an alternate solution that actually adds your certificate to the built in list of default certificates: <a href="https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https/6378872#6378872">Trusting all certificates using HttpClient over HTTPS</a>

However, it will only work for your application. There's no way to programmatically do it for all applications on a user's device, since that would be a security risk.

blocks|key|1062021|text|为了能够使用startssl证书，我所做的事情非常简单。(在我扎根的手机上)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1062022|我将/system/etc/security/cacerts.bks复制到我的sdcard|1062023|已下载http://www.startssl.com/certs/ca.crt和http://www.startssl.com/certs/sub.class1.server.ca.crt|offset|length|1062024|转到portecle.sourceforge.net并直接从网页上运行portecle。|1062025|从我的SD卡中打开我的cacerts.bks文件(当被要求输入密码时没有输入任何内容)|1062026|在portacle中选择import并打开sub.class1.server.ca.crt，在我的情况下，它已经有了ca.crt，但也许你也需要安装它。|1062027|保存密钥库并将其备份到/system/etc/security/cacerts.bks+(我首先备份了该文件，以防万一)|1062028|我重新启动了我的手机，现在我可以使用startssl证书检查我的站点了，没有错误。|1062029|entityMap|0|LINK|mutability|MUTABLE|url|http://www.startssl.com/certs/ca.crt|1|http://www.startssl.com/certs/sub.class1.server.ca.crt^0|0|0|3|10|0|14|1I|1|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|12|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|13|8|@]|9|@$F|14|G|15|1|16]|$F|17|G|18|1|19]]|A|$]]|$1|H|3|I|5|6|7|1A|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|1B|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|1C|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|1D|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1E|8|@]|9|@]|A|$]]|$1|R|3|-4|5|6|7|1F|8|@]|9|@]|A|$]]]|S|$T|$5|U|V|W|A|$X|Y]]|Z|$5|U|V|W|A|$X|10]]]]

What I did to beable to use startssl certificates was quite easy. (on my rooted phone)

I copied /system/etc/security/cacerts.bks to my sdcard

Downloaded <a href="http://www.startssl.com/certs/ca.crt" rel="nofollow">http://www.startssl.com/certs/ca.crt</a> and <a href="http://www.startssl.com/certs/sub.class1.server.ca.crt" rel="nofollow">http://www.startssl.com/certs/sub.class1.server.ca.crt</a> 

Went to portecle.sourceforge.net and ran portecle directly from the webpage.

Opened my cacerts.bks file from my sdcard (entered nothing when asked for a password)

Choose import in portacle and opened sub.class1.server.ca.crt, im my case it allready had the ca.crt but maybe you need to install that too. 

Saved the keystore and copied it baxck to /system/etc/security/cacerts.bks (I made a backup of that file first just in case)

Rebooted my phone and now I can vist my site thats using a startssl certificate without errors.

blocks|key|847716|text|有一个比在这里张贴或在相关帖子中更容易解决这个问题的方法。如果您正在使用webview+(就像我一样)，您可以通过在其中执行JAVASCRIPT函数来实现此目的。如果您不使用webview，则可能需要为此创建一个隐藏的webview。这里有一个功能，可以在任何浏览器(或webview)上启动ca安装(通常通过共享的os+cert存储库，包括在Droid上)。它在iFrames中使用了一个很好的技巧。只需将.crt文件的url传递给此函数：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|847717|function+installTrustedRootCert(+rootCertUrl+){
++++id+=+"rootCertInstaller";
++++iframe+=+document.getElementById(+id+);
++++if(+iframe+!=+null+)+document.body.removeChild(+iframe+);
++++iframe+=+document.createElement(+"iframe"+);
++++iframe.id+=+id;
++++iframe.style.display+=+"none";
++++document.body.appendChild(+iframe+);
++++iframe.src+=+rootCertUrl;
}|code-block|syntax|javascript|847718|更新：|847719|iframe技巧适用于API19及以上版本的Droids，但旧版本的webview不能像这样工作。不过，一般的想法仍然有效--只需下载/打开文件，然后让操作系统接管。这可能是一个更简单、更通用的解决方案(在现在的java中)：|847720|+public+static+void+installTrustedRootCert(+final+String+certAddress+){
+++++WebView+certWebView+=+new+WebView(+instance_+);
+++++certWebView.loadUrl(+certAddress+);
+}|847721|请注意，instance_是对活动的引用。如果您知道证书的url，则可以完美地工作。然而，在我的例子中，我用服务器端软件动态地解决了这个问题。我不得不添加相当多的额外代码来拦截重定向url，并以一种不会导致基于线程复杂性的崩溃的方式调用它，但我不会在这里添加所有的混乱……|847722|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|T|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|U|8|@]|9|@]|A|$E|F]]|$1|M|3|N|5|6|7|V|8|@]|9|@]|A|$]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

There is a MUCH easier solution to this than posted here, or in related threads. If you are using a webview (as I am), you can achieve this by executing a JAVASCRIPT function within it. If you are not using a webview, you might want to create a hidden one for this purpose. Here's a function that works in just about any browser (or webview) to kickoff ca installation (generally through the shared os cert repository, including on a Droid). It uses a nice trick with iFrames. Just pass the url to a .crt file to this function:

<pre><code>function installTrustedRootCert( rootCertUrl ){
 id = "rootCertInstaller";
 iframe = document.getElementById( id );
 if( iframe != null ) document.body.removeChild( iframe );
 iframe = document.createElement( "iframe" );
 iframe.id = id;
 iframe.style.display = "none";
 document.body.appendChild( iframe );
 iframe.src = rootCertUrl;
}
</code></pre>

UPDATE:

The iframe trick works on Droids with API 19 and up, but older versions of the webview won't work like this. The general idea still works though - just download/open the file with a webview and then let the os take over. This may be an easier and more universal solution (in the actual java now):

<pre><code> public static void installTrustedRootCert( final String certAddress ){
 WebView certWebView = new WebView( instance_ );
 certWebView.loadUrl( certAddress );
 }
</code></pre>

Note that instance_ is a reference to the Activity. This works perfectly if you know the url to the cert. In my case, however, I resolve that dynamically with the server side software. I had to add a fair amount of additional code to intercept a redirection url and call this in a manner which did not cause a crash based on a threading complication, but I won't add all that confusion here...

blocks|key|1062114|text|如果您有根设备，则可以使用Magisk模块将用户证书移动到系统，使其成为受信任的证书|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1062115|https://github.com/Magisk-Modules-Repo/movecert|offset|length|1062116|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|1B|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@$D|O|E|P|1|Q]]|A|$]]|$1|F|3|-4|5|6|7|R|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|C]]]]

If you have a rooted device, you can use a Magisk Module to move User Certs to System so it will be Trusted Certificate
<a href="https://github.com/Magisk-Modules-Repo/movecert" rel="nofollow noreferrer">https://github.com/Magisk-Modules-Repo/movecert</a>

I have created my own CA certificate and now I want to install it on my Android Froyo device (HTC Desire Z), so that the device trusts my certificate. 

Android stores CA certificates in its Java keystore in <code>/system/etc/security/cacerts.bks</code>. I copied the file to my computer, added my certificate using <a href="http://portecle.sourceforge.net/" rel="noreferrer">portecle 1.5</a> and pushed it back to the device. 

Now, Android does not seem to reload the file automatically. I have read in several blog posts that I need to restart the device. Doing so results in the file being overwritten with the original one again.

My next try was to install the certificate from SD card by copying it and using the according option from the settings menu. The device tells me that the certificate has been installed, but apparently it does not trust the certificate. Moreover, when I try to copy the keystore to my computer, I still find the original stock <code>cacerts.bks</code>.

So, what is the right way to install my own root CA certificate on an Android 2.2 device as a trusted certificate? Is there a way to do it programmatically?

How to install trusted CA certificate on Android device?

服务器

Android

Java

我已经创建了自己的CA证书，现在我想将其安装在我的Android Froyo设备(HTC Desire Z)上，以便该设备信任我的证书。安卓将CA证书存储在/system/etc/security/cacerts.bks的Java密钥库中。我将文件复制到我的计算机上，使用添加我的证书，并将其推送回设备。现在，Andro...

问如何在Android设备上安装可信CA证书？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Android设备上安装可信CA证书？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Android设备上安装可信CA证书？
EN