guardianproject/cacert

A slightly more vetted version of the Android CACert keystore

Guardian Project CA Bundle for Android

In response to growing concerns about the less-than trustworthy state of the global Certificate Authority ecosystem, we have decided to began curating our own CACert keystore for use on Android devices.

This certificate bundle contains all the CAs from the Mozilla CA Certificate Store as obtained through Debian's ca-certificates package.

TODO: How to use the pinned certificate store?

Projects using this cacert

• NetCipher - strong TLS verification and proxy library for Android

Usage

We rely on Debian's tool to parse the Mozilla trust database and output PEM encoded certificates, which we then combine into a keystore ready for inclusion in Android.

    git submodule update --init --recursive
    make

The resulting keystore will be in stores/debiancacerts.bks ready to be imported into an Android project.

Add it as a raw resource to your project, then use something like the following to load it:

    mTrustStore = KeyStore.getInstance("BKS");
    in = mContext.getResources().openRawResource(R.raw.cacerts);
    mTrustStore.load(in, new String("changeit").toCharArray());

Relevant Reading

• DigiNotar Debacle
• Your app shouldn't suffer SSL's problems
• Unifying Key Store Access in ICS
• ICS Trust Store Implementation

Credits

We would like to ack Open WhisperSystems as an inspiration for this, as they were able to push out a small patch through their WhisperCore update tool in order to modify the keystore to remove DigiNotar.

cacert's Issues

Not listed in app launcher

ADW Launcher, stock Android 2.2 on SGS. As the title says, the app is not listed in the app launcher. But it DID launch from the post-install screen that let you run the app you've just installed. You should add a launcher icon ASAP!

Android 2.1

Is it possible to make CaCertMan working for Android 2.1 and earlier versions?

Make failure

I cloned the repo, ran git submodule update --init --recursive, then tried to run make. That gave me:

cd ca-certificates && git verify-tag `git describe --abbrev=0 --tags`
gpg: Signature made Sun 20 Jan 2013 07:47:44 PM EST using RSA key ID FE4B2BDA
gpg: Can't check signature: public key not found
make: *** [debian-verify] Error 1

Is there some other preparation step needed to build the BKS store via make?

Thanks!

FileNotFound results in endless "Working..." on opening screen on Android 4.0 and newer

My preliminary testing shows this app suffers from changes in Android

reference: moxie0/AndroidPinning#1

Slight README Typo

You have:

our own CACert keystore for us on Android devices

I am guessing that "us" is supposed to be "use", as that would make more sense given the overall context.

BTW, thanks for making this available, and the other work the Guardian Project does. I can't find a donation link on the main site -- is there one that I'm missing?

import cert feature

Use case: For self-signed certs of personal websites.

CA Cert question

Been playing around with a device on froyo. Just wanted to ask as i'm not sure if I modified my cacert file correctly

I couldn't get this tool to work so just made a couple scripts

The first deleted all certs in the cacert file from system/etc/security
The second then added all of the certs from the debian package using keytool and bouncycastle

Is this correct or could I have messed something up by deleting all the certs already in the file? The reason I deleted them all was because majority of them were being flagged as already existing in the file

Add list of required deps to run this project & Containerfile to run it

I wrote the below Containerfile to use this project:
The list of deps to run this project are:
git make ca-certificates gnupg python2 openjdk-17-jre-headless
(openjdk is for keytool)

build with podman build --rm -t cacertoolguardian -f CaCertGuardionTool

CaCertGuardionTool content:

FROM docker.io/debian:sid-slim

RUN set -ex; \
    mkdir -p /usr/share/man/man1/; \
    apt-get update; \
    DEBIAN_FRONTEND=noninteractive apt-get install --yes -o APT::Install-Suggests=false --no-install-recommends git make ca-certificates gnupg python2 openjdk-17-jre-headless; \
    ln -s /usr/bin/python2 /usr/bin/python; \
    rm -rf /var/lib/apt/lists/*; \
    useradd -ms /bin/bash appuser; 

USER appuser
RUN set -ex; \
    cd /home/appuser/; \
    gpg --keyserver keyring.debian.org --recv-keys A278B781FE4B2BDA; \
    git clone --depth 1 https://github.com/guardianproject/cacert; \
    cd cacert; \
    sed -i 's/git:\/\/anonscm.debian.org\/git\/collab-maint\/ca-certificates.git/https:\/\/salsa.debian.org\/debian\/ca-certificates.git/g' .gitmodules; \
    git submodule update --init --recursive; \
    make
    
WORKDIR /home/appuser/

download/install curated cacerts from github

evanskaufman Evan Kaufman
@
@guardianproject Shouldn't the app have a way to install your "curated" cacerts.bks file, perhaps directly from @github?

Consider publishing, or unpublishing, BKS store for use

The project README indicates that the expected usage is to build your own BKS store. As I just pointed out in issue #9, the instructions may be missing a step for doing that.

However, I note that you have committed the output (stores/debiancacerts.bks) to the repo.

Is this a BKS file that we are supposed to use? If yes, what is the keystore password? Your sample code shows changeit, which seems suspiciously like a placeholder... :-)

If it is not something that we are supposed to use, you might consider removing it from the repo. That being said, I would encourage you to consider publishing a generated BKS file with a known password, perhaps in the Releases area. While being able to reproduce your work is great, at the end of the day, developers need the BKS store, more than they need the ability to generate the BKS store.

Thanks!

Replace anonscm.debian.org as it's closed with salsa

in:

cacert/.gitmodules

Line 3 in 866e065

url = git://anonscm.debian.org/git/collab-maint/ca-certificates.git

Visiting https://anonscm.debian.org/ return:

The alioth.debian.org service is discontinued. Its replacement is a GitLab instance at salsa.debian.org.

Replacing above line with this works:

	url = https://salsa.debian.org/debian/ca-certificates.git

Backup issue

I'm getting this error on trying to backup the CA certs:

Error: The keystore was not saved./data/data/[something-guardianproject-something](Is a directory)
(It's annoying to write the full path from memory, and I guess you already know which one it is already anyway.)

Samsung Galaxy S, stock 2.2, rooted, Busybox (version number is something ending in 18). What could the problem be?

(A bit OT, but I'm not seeing DigiNotar, but I assume the app shows the complete list and that just means I never had that CA cert on the phone, right?)

Failure to save:Cannot write to: /system/etc/security/cacerts.bks

Using the alpha release of the app, I get the toast error notification Failure to save:Cannot write to: /system/etc/security/cacerts.bks when I try to save, and it's allowed (and remembered) in Superuser.

This is on a rooted Nexus One running CyanogenMod-7.0.3-N1. Following is a segment of a logcat, please let me know if you need the whole thing.

https://gist.github.com/0843f7c2766448ef10be