# Android 14 blocks modification of system certificates, even as root

DevFeed: [Android 14 blocks modification of system certificates, even as root](<https://devfeed.tech/articles/android-14-blocks-modification-of-system-certificates-even-as-root-19037.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/android-14-breaks-system-certificate-installation/>)

Author: HTTP Toolkit; Tim Perry

Published: 2023-09-05T14:00:00Z

Content type: article

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Android](<https://devfeed.tech/topics/android.md>), [Security](<https://devfeed.tech/topics/security.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [android-14](<https://devfeed.tech/tags/android-14.md>), [api](<https://devfeed.tech/tags/api.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [interception](<https://devfeed.tech/tags/interception.md>), [root](<https://devfeed.tech/tags/root.md>), [security](<https://devfeed.tech/tags/security.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

The article examines Android 14's tighter restrictions on modifying trusted certificate authorities, including on rooted devices, and the resulting challenges for developers, testers, and researchers. An update notes that multiple workarounds now allow certificate injection.

## Source excerpt

Update: This post sparked a lot of excellent discussion and debate on workarounds, and there are now multiple working solutions to allow certificate injection on Android 14, despite the restrictions discussed here. See the update post for more details. When Android was initially announced in 2007 by the Open Handset Alliance (headed by Google) their flagship project was billed as an "open platform", "providing developers a new level of openness", and giving them "complete access to handset capabilities and tools". We've come a long way since then, steadily retreating from openness & user control of devices, and shifting towards a far more locked-down vendor-controlled world. The next step of Android's evolution is Android 14 (API v34, codename Upside-Down Cake) and it takes more steps down that path. In this new release, the restrictions around certificate authority (CA) certificates become significantly tighter, and appear to make it impossible to modify the set of trusted certificates at all, even on fully rooted devices. If you're an Android developer, tester, reverse engineer, or anybody else interested in directly controlling who your device trusts, this is going to create some new challenges. Before we get into the finer details, first I want to talk a little about the context around Android CA management and how we got here, but if you want to jump to the latest details you can go straight to the Enter Android 14 section below. "Open Software, Open Device, Open Ecosystem" While the initial principles of Android were very much focused on open software, controllable by users and developers, over more recent years Android has increasingly limited the control of users, developers & researchers over their own devices. The key turning point in this process was Android 7 (Nougat, released in 2016) in which the certificate authorities (CAs) on the device that were previously fully modifiable by the owner of the phone were split in two: one fixed list of CAs provided