blocks|key|2115689|text|我想出了一种方法来做到这一点，因此我能够信任charles代理证书。它将作为受信任的SSL根证书添加。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2115690|首先，您需要获取证书哈希。|2115691|openssl+x509+-inform+PEM+-subject_hash_old+-in+charles-proxy-ssl-proxying-certificate.pem+%7C+head+-1>toto|code-block|syntax|javascript|2115692|我使用windows，将其存储在事务中的var中，以使流程set+/p+totoVar=<toto自动化。|offset|length|style|CODE|2115693|set+totoVar=%25totoVar%25.0+&&+DEL+toto

cat+charles-proxy-ssl-proxying-certificate.pem+>+%25totoVar%25

openssl+x509+-inform+PEM+-text+-in+charles-proxy-ssl-proxying-certificate.pem+-out+nul+>>+%25totoVar%25

adb+shell+mount+-o+rw,remount,rw+/system

adb+push+%25totoVar%25+/system/etc/security/cacerts/

adb+shell+mount+-o+ro,remount,ro+/system

adb+reboot|2115694|entityMap^0|0|0|0|T|K|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|V|8|@$K|W|L|X|M|N]]|9|@]|A|$]]|$1|O|3|P|5|F|7|Y|8|@]|9|@]|A|$G|H]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

I figured out a way to do this, thus i was able to trust charles proxy certificate. it will be added as trusted SSL root certificate.

First you need to get the certificate hash

<pre><code>openssl x509 -inform PEM -subject_hash_old -in charles-proxy-ssl-proxying-certificate.pem | head -1&gt;toto
</code></pre>

i use windows, store it in a var in a matter to automate the process <code>set /p totoVar=&lt;toto</code>

<pre><code>set totoVar=%totoVar%.0 &amp;&amp; DEL toto

cat charles-proxy-ssl-proxying-certificate.pem &gt; %totoVar%

openssl x509 -inform PEM -text -in charles-proxy-ssl-proxying-certificate.pem -out nul &gt;&gt; %totoVar%

adb shell mount -o rw,remount,rw /system

adb push %totoVar% /system/etc/security/cacerts/

adb shell mount -o ro,remount,ro /system

adb reboot
</code></pre>

blocks|key|2076676|text|由于这个答案，通过ADB安装用户证书，我能够修改一个在bash上工作的脚本：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2076677|PEM_FILE_NAME=logger-charles-cert.pem
hash=$(openssl+x509+-inform+PEM+-subject_hash_old+-in+$PEM_FILE_NAME+%7C+head+-1)
OUT_FILE_NAME="$hash.0"

cp+$PEM_FILE_NAME+$OUT_FILE_NAME
openssl+x509+-inform+PEM+-text+-in+$PEM_FILE_NAME+-out+/dev/null+>>+$OUT_FILE_NAME

echo+"Saved+to+$OUT_FILE_NAME"
adb+shell+mount+-o+rw,remount,rw+/system
adb+push+$OUT_FILE_NAME+/system/etc/security/cacerts/
adb+shell+mount+-o+ro,remount,ro+/system
adb+reboot|code-block|syntax|javascript|2076678|(是的，我知道这可能是个评论，但我还没有足够的声誉把它作为评论发布)|2076679|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/44942851/install-user-certificate-via-adb/46569793#46569793^0|7|B|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@$A|T|B|U|1|V]]|C|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|X|8|@]|9|@]|C|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]]]

Thanks to this answer <a href="https://stackoverflow.com/questions/44942851/install-user-certificate-via-adb/46569793#46569793">Install User Certificate Via ADB</a> I was able to adapt a script that works on a bash shell:
<pre><code>PEM_FILE_NAME=logger-charles-cert.pem
hash=$(openssl x509 -inform PEM -subject_hash_old -in $PEM_FILE_NAME | head -1)
OUT_FILE_NAME=&quot;$hash.0&quot;

cp $PEM_FILE_NAME $OUT_FILE_NAME
openssl x509 -inform PEM -text -in $PEM_FILE_NAME -out /dev/null &gt;&gt; $OUT_FILE_NAME

echo &quot;Saved to $OUT_FILE_NAME&quot;
adb shell mount -o rw,remount,rw /system
adb push $OUT_FILE_NAME /system/etc/security/cacerts/
adb shell mount -o ro,remount,ro /system
adb reboot
</code></pre>
(Yes, I know this should probably be a comment, but I don't have enough reputation to post it as a comment yet)

blocks|key|2076694|text|通过以下步骤，我能够在选项卡(而不是系统选项卡，其他答案显示的系统选项卡)下显示一个服务器证书：|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|2076695|#!/bin/bash
subjectHash=`openssl+x509+-inform+PEM+-subject_hash_old+-in+server.crt+%7C+head+-n+1`
openssl+x509+-in+server.crt+-inform+PEM+-outform+DER+-out+$subjectHash.0
adb+root
adb+push+./$subjectHash.0+/data/misc/user/0/cacerts-added/$subjectHash.0
adb+shell+"su+0+chmod+644+/data/misc/user/0/cacerts-added/$subjectHash.0"
adb+reboot|code-block|syntax|javascript|2076696|entityMap^0|B|V|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

I was able to get a server cert to show up under the <code>Trusted Credential -&gt; User</code> tab (rather than the system tab, which other answers show) with the following steps:

<pre><code>#!/bin/bash
subjectHash=`openssl x509 -inform PEM -subject_hash_old -in server.crt | head -n 1`
openssl x509 -in server.crt -inform PEM -outform DER -out $subjectHash.0
adb root
adb push ./$subjectHash.0 /data/misc/user/0/cacerts-added/$subjectHash.0
adb shell "su 0 chmod 644 /data/misc/user/0/cacerts-added/$subjectHash.0"
adb reboot
</code></pre>

blocks|key|2115804|text|在我的例子中，我首先需要以可写的方式启动模拟器：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2115805|adb+start-server
emulator+-writable-system+-avd+Pixel_2_API_24|code-block|syntax|javascript|2115806|然后可以安装证书：|2115807|adb+root
adb+remount
adb+push+c8750f0d.0+/system/etc/security/cacerts|2115808|https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android|offset|length|2115809|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|0|0|0|21|0|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|W|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|X|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|Y|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|Z|8|@]|9|@$M|10|N|11|1|12]]|A|$]]|$1|O|3|-4|5|6|7|13|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|L]]]]

In my case, I first needed to start the emulator as writable:
<pre><code>adb start-server
emulator -writable-system -avd Pixel_2_API_24
</code></pre>
Then you can install certificate:
<pre><code>adb root
adb remount
adb push c8750f0d.0 /system/etc/security/cacerts
</code></pre>
<a href="https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android" rel="nofollow noreferrer">https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android</a>

blocks|key|780064|text|2022：httptoolkit有一个很好的解决方案，可以在不重新启动的情况下将自定义的cert+注入到根设备/模拟器中。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|780065|详细信息：https://httptoolkit.tech/blog/intercepting-android-https/#injecting-ca-certificates-into-rooted-devices|780066|++++set+-e+#+Fail+on+error
++++#+Create+a+separate+temp+directory,+to+hold+the+current+certificates
++++#+Without+this,+when+we+add+the+mount+we+can't+read+the+current+certs+anymore.

++++mkdir+-m+700+/data/local/tmp/htk-ca-copy
++++#+Copy+out+the+existing+certificates

++++cp+/system/etc/security/cacerts/*+/data/local/tmp/htk-ca-copy/
++++#+Create+the+in-memory+mount+on+top+of+the+system+certs+folder

++++mount+-t+tmpfs+tmpfs+/system/etc/security/cacerts
++++#+Copy+the+existing+certs+back+into+the+tmpfs+mount,+so+we+keep+trusting+them

++++mv+/data/local/tmp/htk-ca-copy/*+/system/etc/security/cacerts/
++++#+Copy+our+new+cert+in,+so+we+trust+that+too

++++mv+${certificatePath}+/system/etc/security/cacerts/
++++#+Update+the+perms+&+selinux+context+labels,+so+everything+is+as+readable+as+before

++++chown+root:root+/system/etc/security/cacerts/*
++++chmod+644+/system/etc/security/cacerts/*
++++chcon+u:object_r:system_file:s0+/system/etc/security/cacerts/*
++++#+Delete+the+temp+cert+directory+&+this+script+itself

++++rm+-r+/data/local/tmp/htk-ca-copy
++++rm+${injectionScriptPath}
++++echo+"System+cert+successfully+injected"|code-block|syntax|javascript|780067|来源|780068|entityMap|0|LINK|mutability|MUTABLE|url|https://httptoolkit.tech/blog/intercepting-android-https/#injecting-ca-certificates-into-rooted-devices|1|https://github.com/httptoolkit/httptoolkit-server/blob/8a4b4d283fbe98694ddd09a44d6e9c9941aa91e2/src/interceptors/android/adb-commands.ts#L200-L253^0|0|4|1D|C|0|0|30|5|2V|0|0|0|0|2|0|2|1|0^^$0|@$1|2|3|4|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|13|8|@$9|14|A|15|B|C]]|D|@$9|16|A|17|1|18]]|E|$]]|$1|H|3|I|5|J|7|19|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|1A|8|@$9|1B|A|1C|B|C]]|D|@$9|1D|A|1E|1|1F]]|E|$]]|$1|O|3|-4|5|6|7|1G|8|@]|D|@]|E|$]]]|P|$Q|$5|R|S|T|E|$U|V]]|W|$5|R|S|T|E|$U|X]]]]

2022: httptoolkit has a good solution to inject a custom cert without rebooting into rooted devices/emulators
Details here: <a href="https://httptoolkit.tech/blog/intercepting-android-https/#injecting-ca-certificates-into-rooted-devices" rel="nofollow noreferrer">https://httptoolkit.tech/blog/intercepting-android-https/#injecting-ca-certificates-into-rooted-devices</a>
<pre><code> set -e # Fail on error
 # Create a separate temp directory, to hold the current certificates
 # Without this, when we add the mount we can't read the current certs anymore.

 mkdir -m 700 /data/local/tmp/htk-ca-copy
 # Copy out the existing certificates

 cp /system/etc/security/cacerts/* /data/local/tmp/htk-ca-copy/
 # Create the in-memory mount on top of the system certs folder

 mount -t tmpfs tmpfs /system/etc/security/cacerts
 # Copy the existing certs back into the tmpfs mount, so we keep trusting them

 mv /data/local/tmp/htk-ca-copy/* /system/etc/security/cacerts/
 # Copy our new cert in, so we trust that too

 mv ${certificatePath} /system/etc/security/cacerts/
 # Update the perms &amp; selinux context labels, so everything is as readable as before

 chown root:root /system/etc/security/cacerts/*
 chmod 644 /system/etc/security/cacerts/*
 chcon u:object_r:system_file:s0 /system/etc/security/cacerts/*
 # Delete the temp cert directory &amp; this script itself

 rm -r /data/local/tmp/htk-ca-copy
 rm ${injectionScriptPath}
 echo &quot;System cert successfully injected&quot;
</code></pre>
<a href="https://github.com/httptoolkit/httptoolkit-server/blob/8a4b4d283fbe98694ddd09a44d6e9c9941aa91e2/src/interceptors/android/adb-commands.ts#L200-L253" rel="nofollow noreferrer">Source</a>

blocks|key|2115878|text|将文件推送到设备|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2115879|adb+push+"C:\path\cacert.cer"+"/data/local"|code-block|syntax|javascript|2115880|启动CertInstaller|2115881|adb+shell+am+start+-n+com.android.certinstaller/.CertInstallerMain+-a+android.intent.action.VIEW+-t+application/x-x509-ca-cert+-d+file:///data/local/cacert.cer|2115882|现在使用将出现在设备上的提示符完成安装。|2115883|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

Push file to device
<pre><code>adb push &quot;C:\path\cacert.cer&quot; &quot;/data/local&quot;
</code></pre>
Start the CertInstaller
<pre><code>adb shell am start -n com.android.certinstaller/.CertInstallerMain -a android.intent.action.VIEW -t application/x-x509-ca-cert -d file:///data/local/cacert.cer
</code></pre>
Now finish installing with the prompt that will appear on your device.

Is there a way to install CA certificate (<code>.crt</code> file) under the <code>Security -&gt; Trusted Credential -&gt; User tab</code> via ADB? or any other "scriptable" way.

Install User Certificate Via ADB

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

是否有办法通过亚行在.crt下安装CA证书( Security -> Trusted Credential -> User tab文件)？或者任何其他的“脚本”方式。

问通过ADB安装用户证书
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问通过ADB安装用户证书EN