# Android 11 tightens restrictions on CA certificates

DevFeed: [Android 11 tightens restrictions on CA certificates](<https://devfeed.tech/articles/android-11-tightens-restrictions-on-ca-certificates-19036.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/android-11-trust-ca-certificates/>)

Author: HTTP Toolkit; Tim Perry

Published: 2020-09-10T16:30:00Z

Content type: article

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Android](<https://devfeed.tech/topics/android.md>), [Network](<https://devfeed.tech/topics/network.md>), [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [android-testing](<https://devfeed.tech/tags/android-testing.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [interception](<https://devfeed.tech/tags/interception.md>), [network](<https://devfeed.tech/tags/network.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

This article explains how Android 11 further restricts the installation of Certificate Authority certificates. Apps, debugging tools, and user actions can no longer prompt installation into the user-managed certificate store; users must use a hidden settings page instead. The change affects legitimate Android testing, debugging, reverse engineering, and enterprise network configuration use cases.

## Source excerpt

Your trusted Certificate Authorities (CAs) are the organizations that you trust to guarantee the signatures of your encrypted traffic and content. That's a lot of power, and the list of trusted authorities is dangerous to mess around with. Nonetheless, it's also something that power users might want to configure, for Android testing, for app debugging, for reverse engineering or as part of some enterprise network configurations. Android has tightly restricted this power for a while, but in Android 11 (released this week) it locks down further, making it impossible for any app, debugging tool or user action to prompt to install a CA certificate, even to the untrusted-by-default user-managed certificate store. The only way to install any CA certificate now is by using a button hidden deep in the settings, on a page that apps cannot link to. To be clear, carefully managing the trusted CAs on Android devices is important! Adding a CA should not be easy to do by accident or unknowingly. Protecting users from themselves is absolutely necessary here, and it's a hard problem. That said, there are many legitimate use cases where you want to be able to choose which CAs you trust, and that just got much harder. There's a balance here to manage, and I'm not sure Android has made the right choice. Let's dig into the details: How did Android CA certificate management work until now? Until now, an app could ask a user to trust a CA certificate in the user certificate store (but not the system store), using the KeyChain.createInstallIntent() API method. Similarly, the operating system would offer to trust a CA certificate if one was manually opened on the device from the filesystem. These certificate trust prompts came with a variety of loud warnings & confirmations, and mandated setup of a device pin or other screen lock before you could complete them, if one wasn't already set. It wasn't possible to do accidentally, and it was hard to trick users into accepting these scary prompt