Currently for Android we have two certificate prefixes, "system" and "user". System certificates are baked into the build and cannot be changed after the fact. User certificates can be installed after the fact, but they only get used for that user. For a device owner that wants to control certificates across the entire device this is problematic.

Would it be possible to have a third prefix, "managed" where device owners can install certificates into and will apply globally across the entire device (not just one user)?

I have uploaded an initial implementation of this on AOSP Gerrit for review, I have tested this with an MDM that pushes certificates to the device and tested with an app that allows certificates from the 'managed' trust anchor in their NSC config: https://android-review.googlesource.com/q/topic:%22managed-certificates%22

I also have a pull request open on the conscrypt org as well: https://github.com/google/conscrypt/pull/1202

Could this feature request be routed to the conscrypt team so we can get the right people looped in?

Thanks!

Issue 331927559

Links (2)

Issue metadata