Where to view certificates on Android: system, user and root

Android certificates are digital “passports” that confirm the authenticity of sites, applications and network connections. They provide data encryption, protection against phishing, and the correct operation of corporate VPNs, banking applications, or even system updates. But where to look for them if you need to check the authenticity of a certificate, remove a suspicious one, or install a new one? In this article we will look at all the methods - from standard settings to tools for advanced users.

The problem is that Android hides most certificates deep in system files, and the interface for viewing them depends on the OS version and the manufacturer's shell (MIUI, One UI, ColorOS etc.). In addition, user certificates (manually installed) and system certificates (hardwired into the firmware) are stored in different places. We will show you how to access them without and with root access, and also warn about the risks of careless manipulation.

1. Certificates in Android settings: standard method

The easiest method is to use the built-in device settings. It is suitable for viewing user certificates (installed by you or applications) and part system. The instructions are relevant for Android 10–14, but the path may differ slightly on custom firmware.

Open Settings → Security → Advanced → Encryption and Credentials → User Certificates. Here you will see a list of manually installed certificates (for example, for working with corporate email or VPN). To view the system ones, go to the Trusted credentials section - certificates pre-installed on the system will be displayed there (for example, Let’s Encrypt, DigiCert or GlobalSign).

• 🔍 User certificates —those that you imported yourself (files .crt, .p12, .pfxYou can delete them directly from this menu.
• 🛡️ System certificates —built into the firmware. not possible.
• 🔗 Wi-Fi/VPN certificates —can be displayed separately if used for authentication on networks.

On some devices (for example, Samsung or Xiaomi) the path may look different:

• For One UI: Settings → Biometrics and security → Other security settings → View security certificates.
• For MIUI: Settings → Passwords and security → Privacy → Advanced → User certificates.

⚠️ Attention: Removing a user certificate may disrupt the operation of VPN, corporate email or banking applications. If the certificate is installed by an application (for example, 1C or CryptoPro), its deletion will lead to authentication errors.

2. Viewing certificates through applications

If the built-in settings do not show the required certificates or you want to see their detailed properties (issuer, expiration date, fingerprint), use third-party utilities. They provide more information than the standard Android interface.

Here are the top 3 applications for working with certificates:

• 📱 Certificate Inspector —shows all installed certificates, including system ones, with the ability to export to a file. Supports checking the chain of trust.
• 🔎 Network Security Config Analyzer —analyzes certificates used by applications for network connections (useful for debugging HTTPS errors).
• 🛠️ PortDroid Network Analyzer —includes a module to check SSL/TLS certificates of sites and applications in real time.

Example of working with Certificate Inspector:

1. Install the application from Google Play.
2. Launch it and provide access to the certificate store (confirmation via adb on some devices may be required).
3. In the main menu, select the tab User (user) or System (system).
4. Click on the certificate to see its properties: Issuer (issuer), Subject (subject), Valid From/To (validity period), Fingerprint (fingerprint).

For advanced users, the function of exporting a certificate to a file .pem or .deris useful. This is useful if you need to transfer a certificate. to another device or analyze it on a PC using OpenSSL.

⚠️ Attention: Some applications (for example, banking) block work on devices with user certificates if they do not comply with their security policy. Before installing a new certificate, check the application requirements.

3. Certificates in the Android file system (for advanced users)

All certificates on Android are stored in the file system in encrypted or open form. Their location depends on the type:

To view certificate files without root access, you can use adb shell:

adb shell ls /system/etc/security/cacerts/
adb pull /system/etc/security/cacerts/ ~/Downloads/android_certs

This command will copy the system certificates to a folder Downloads on your PC. To read them, rename the files by adding the extension .crtand open by double clicking. (Windows/Linux/macOS recognizes them as certificates).

To work with user certificates without root access, use adb backup:

adb backup -f certs.ab -noapk com.android.providers.settings

This backup will contain settings, including certificates. To extract them, you will need a special utility, for example, android-backup-extractor.

openssl x509 -inform DER -in a0d4b52d.0 -out certificate.crt

4. Viewing website certificates in the browser

If you need to check the certificate of a specific site (for example, to ensure its authenticity before entering payment data), you can do this directly in the browser. The instructions are suitable for Chrome, Firefox And Samsung Internet.

Open the site. whose certificate you want to check, and follow these steps:

1. Click on the lock icon 🔒 in the address bar.
2. Select Certificate (in Chrome) or More details → View certificate (in Firefox).
3. In the tab General you will see to whom the certificate was issued and by whom it was signed.
4. Go to the Composition or Detailstab to see:
   • 📅 Validity period (Valid from — Valid to).
   • 👤 Issuer (Issuer).
   • 🔑 Fingerprint (Thumbprint or SHA-256 Fingerprint).
   • 🔗 Chain of trust (Certification Path).

If the certificate is self-signed (issued by the site itself) or expired, the browser will show warning NET::ERR_CERT_INVALID. In this case, it is better not to continue working with the site - this may be a phishing attempt.

openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -text

Replace example.com to the desired domain. The command will display complete information about the certificate, including its chain.-->

5. Using ADB for deep certificate analysis

ADB (Android Debug Bridge) allows you to access certificates that are not visible in the standard interface. This method is useful for diagnosing problems with HTTPS, VPN, or enterprise applications.

Here's how to list all trusted certificates via adb:

adb shell cmd package list certificates

This command will show packages that install their own certificates (for example, com.android.vending for Google Play or enterprise applications).

To export all system certificates to a file on a PC:

adb shell "cat /system/etc/security/cacerts/*" > all_certs.bin
openssl x509 -inform DER -in all_certs.bin -out all_certs.pem

The file all_certs.pem will contain all system certificates in readable form. To analyze a specific certificate, use its hash name (for example, a0d4b52d.0).

If you want to check which certificates a specific application uses, run:

adb shell dumpsys package com.example.app | grep "cert"

Replace com.example.app with the application package identifier (for example, com.whatsapp).

⚠️ Attention: Commands adb require enabled USB debugging (Settings → For developers → USB debugging). On some devices (for example, Huawei or Xiaomi), additional permission may be required in the menu Additional settings for developers.

6. Certificates in corporate (MDM) profiles

If your device is managed through MDM (Mobile Device Management, for example, Microsoft Intune, VMware Workspace ONE or IBM MaaS360), certificates can be installed automatically through a corporate profile. They cannot be deleted or changed without administrator rights.

To view certificates installed through MDM:

1. Open Settings → Accounts (or Users and accounts).
2. Find the section Working profile or Managed profile (the name depends on the MDM solution).
3. Go to Security → Certificates or Credentials.
4. Certificates installed by the administrator will be displayed here. Usually they are marked as Managed by organization.

Features of working with MDM certificates:

• 🔒 They cannot be deleted manually - only through the MDM console.
• 📱 They can block the installation of other certificates (for example, for a personal VPN).
• 🔄 When deleting a work profile, all associated certificates will also be deleted.

If you encounter an error NET::ERR_CERT_AUTHORITY_INVALID on corporate websites, most likely the problem is in the certificate installed via MDM. Contact your organization's support service to update it.

7. Checking certificates via Wireshark (for specialists)

If you need to. analyze network traffic and check which certificates are used when connecting to servers, use Wireshark or tcpdump. This method requires root access or special proxy settings.

Instructions for Wireshark:

1. Install Wireshark on your PC and connect your Android device via USB with debugging enabled.
2. Start traffic capture on the interface adb:

   adb tcpdump -i any -s 0 -w /sdcard/capture.pcap

3. Reproduce the problem (for example, open a site with a certificate error).
4. Stop capturing (Ctrl+C) and copy the file to your PC:

   adb pull /sdcard/capture.pcap ~/Downloads/

5. Open capture.pcap to Wireshark and apply a filter tls.handshake.certificateto see all transferred certificates.

In the window Wireshark you can:

• 🔍 See the chain of certificates (from root to final).
• 🔑 Check fingerprints (Fingerprint) and deadlines actions.
• 🚨 Identify suspicious certificates (for example, self-signed or with an incorrect chain).

⚠️ Attention: Capturing traffic without the consent of network users may violate privacy laws. Use this method only to diagnose your own devices or with the permission of the network administrator.

8. Common problems with certificates and their solutions

Errors related to certificates can block access to sites, applications or corporate resources Here are the most common problems and ways to fix them:

If the problem occurs after updating Android, the manufacturer may have updated the list of trusted root certificates, and old applications have stopped working. In this case:

1. Check if your antivirus or VPN is blocking it. connection.
2. Update the problematic application to the latest version.
3. If you are using a custom certificate, reinstall it.

On devices with Android 10+, Google blocks trust in custom certificates for applications whose target SDK is 24+ (Android 7.0). This means that even if you install the certificate, modern applications. (for example, Chrome or Gmail) ignore it. To bypass this restriction, you need to configure Network Security Config in the application or use special builds (for example, Chrome with the flag --ignore-certificate-errors).

FAQ: Frequently asked questions about certificates on Android