Where are the certificates on Android: search and management

In today's digital world, the security of mobile devices comes to the fore, and a key element of this protection is the certificate system. Every connection to a banking application, corporate network, or simply visiting an HTTPS website is verified through a chain of trust provided by cryptographic certificates. However, not all users know where certificates are located on Android and how to access them to check or delete suspicious files.

Storage of this data is organized in a special protected operating system storage, access to which is limited by default. This is to prevent attackers from injecting fake keys and intercepting your traffic. However, the need to manage this list often arises: when installing corporate profiles, configuring Wi-Fi with corporate authorization, or when adware is detected that has injected its root certificate to filter traffic. Understanding the structure of this storage will help you maintain data confidentiality.

In this article, we will analyze in detail the paths to system and user storage, explain the difference between them and provide step-by-step guide for different shell versions. Android. You will learn how to distinguish a legitimate certificate from a malicious one and what actions to take if an unknown entry appears in the list of trusted authorities.

System storage and security architecture

The operating system Android uses two main types of certificate storage: system and user. The system store contains pre-installed root certificates from major global certificate authorities (CAs), such as DigiCert, GlobalSign or Let's Encrypt. These files are located in a protected section of the system and cannot be changed by ordinary applications without obtaining superuser rights.

Physically, this data is located in the directory /system/etc/security/cacerts. Hundreds of files are stored here in .0 or .pemformat, each of which is a hash on behalf of the issuing organization. Modification of this directory is possible only through ADB with root access or by flashing the device. Any change here can lead to unstable operation of the browser and applications, since they will no longer trust legitimate sites.

For the average user, interfering with the system storage is not necessary and even dangerous. The main task is to control the user section, which may contain certificates installed by you manually or, worse, by malware. The system strictly demarcates these zones to prevent the global chain of trust from being compromised.

⚠️ Attempts to delete or replace files in the system folder /system/etc/security/cacerts without a full backup may result in the device being “bricked” or the operating system being unable to start.

User certificates: where to look for them in settings

The most relevant section for checking the security of your smartphone is the user certificate store. This is where files are installed when connecting to VPN work networks, installing parental control or anti-phishing applications. Unfortunately, viruses also use this place to inject their encryption keys.

The path to this section may differ slightly depending on the device manufacturer and version Android, but the general logic remains the same. You need to open the main settings menu and go to the security section. In modern versions of the interface, this item is often combined with privacy or biometrics settings.

To find the desired menu, use the following navigation algorithm:

• 📱 Open Settings and find the section Security or Biometrics and security.
• 🔍 Scroll down to Other security settings or Encryption and credentials.
• 🔑 Click on the item Trusted Credentials or User Certificates.

On devices with clean Android (Pixel, Motorola) the path often looks like like this: Settings → Security → Advanced → Encryption and Credentials → Trusted Credentials. On smartphones Samsung with the One UI shell, the sequence may be different: Settings → Biometrics and Security → Other Security Settings → User Certificates. It is important to read item names carefully as translations may vary.

Instructions for removing suspicious certificates

If you find an entry with an unclear name in the list of user certificates, for example, associated with an unknown VPN service or a memory cleaning application that you did not install, you need it delete immediately. The presence of such a certificate allows third parties to decrypt your HTTPS traffic, including passwords and correspondence.

The deletion procedure is quite simple, but requires care. After entering the menu User Certificates you will see a list of all installed third-party roots of trust. The system may request proof of identity via PIN, pattern, or fingerprint before allowing changes.

Follow the following steps to clear the storage:

• 🗑️ Click on the name of the suspicious certificate in the list.
• ⚙️ In the information window that opens, select the button Delete or the trash icon.
• ✅ Confirm the action in the dialog box by clicking OK or Delete.

After deleting, it is recommended to reboot the device so that the changes take full effect and cached connections are reset. If the delete button is inactive (gray), this may mean that the certificate was installed by the device administrator through the MDM (Mobile Device Management) profile and cannot be deleted by the user without removing administrator rights.

Comparison of storage types and their purpose

For a better understanding of the security architecture, consider differences between system and user data in the table. This will help you quickly figure out what type of file you see and how critical its presence is in the system.

Characteristics	System certificates	User certificates
Location	/system/etc/security/cacerts	Secure data storage
Deletion access	Root / Flashing only	User accessible
Purpose	Basic trust OS	Corporate networks, VPN, filters
Risk of viruses	Minimal	High (main attack vector)

As can be seen from the table, the main risk area is in the user segment. System certificates are updated along with security patches, while user certificates are added dynamically and require manual control. Checking this list regularly should become a habit, especially if you actively install applications from third-party sources. Android, while custom ones are added dynamically and require manual control. Checking this list regularly should become a habit, especially if you actively install applications from third-party sources.

Hide the key icon in the status bar

Many users notice the appearance of a small key icon in the top status bar (status bar) after installing some applications. This indicator indicates that a user certificate is active on the system, which can intercept encrypted traffic. While this doesn't always mean there's a virus (that's how legitimate antiviruses and ad blockers work), a persistent icon can be annoying.

To remove this icon, you can't just close the app. You must completely remove the corresponding certificate from the settings, as described in the previous section. As long as at least one user root of trust is active, the system will warn you about this with a visual signal, considering the communication channel potentially vulnerable.

In some cases, if you use a corporate profile for work, deleting the certificate will result in loss of access to work resources and mail. In such a situation, the key icon is a normal indicator of the operation of a secure communication channel between your device and the company server. You should delete it only if you quit or changed your device.

⚠️ Attention: If the key icon suddenly appears without you installing new applications, immediately check the list of installed apps and remove all unknown utilities, especially those that promise “Internet speedup” or “free access.”

Using ADB for advanced management

For experienced users who require deeper control or automation of the process, it is possible to manage certificates through the tool ADB (Android Debug Bridge). This method allows you to view installed certificates and delete them programmatically, which is convenient for mass device setup or diagnostics.

To work, you will need to connect your smartphone to a computer with USB debugging enabled. The command to display a list of installed user certificates is as follows:

adb shell pm list packages --user 0 | grep cert

However, direct deletion of system certificates via ADB without root access is impossible due to security policies SELinux. You can use ADB to install new certificates into the user store by passing the command file:

adb push mycert.crt /sdcard/Download/

Then the device needs to open the file through security settings for installation. Direct writing to the system partition via ADB is only possible on rooted devices with an unlocked bootloader, which is strongly not recommended on basic working smartphones due to the risk of disrupting banking applications (SafetyNet/Play Integrity API).

What is SafetyNet and how do certificates affect it?

SafetyNet is Google's service for checking system integrity. The presence of user certificates in itself does not always disrupt the operation of SafetyNet, but if they are used to spoof traffic or mask root access, the service can block the operation of banking applications and Google Pay.

Frequent questions and problems when managing trust

When working with certificates, users often encounter typical situations that raise questions. Below are answers to the most common ones that will help you understand the nuances of the security system Android.

Why can’t I delete a certificate, the button is inactive?

Most likely, this certificate was installed by the device administrator. Check the section Settings → Security → Device Administrators. If there is an active application there (for example, a corporate client or an antivirus), disable its administrator rights, and only then can you delete the associated certificate.

Is it safe to install certificates from Telegram or mail?

Absolutely not. Never install files with the extension .crt or .pemobtained from unverified sources. Attackers often distribute such files under the guise of "tickets", "passes" or "vaccination certificates" in order to gain access to your data.

What should you do if Wi-Fi stops working after deleting the certificate?

If you deleted the root certificate of an enterprise Wi-Fi network (EAP-TLS), the connection will stop working because the phone no longer trusts the point's server access. You will need to reinstall the certificate obtained from your organization's system administrator, or reconfigure the network to use a shared password (PSK), if possible.

Can an ordinary virus itself install a certificate without my knowledge?

On modern versions Android (starting from 7.0 and higher), the system requires mandatory confirmation by the user (enter PIN code) to install any user certificate. The virus cannot do this hidden, unless you yourself entered the unlock code, deceived by a fake system message.

Where is the storage on Android 14 and newer?

In the latest versions Android Google has changed the menu structure. Look for the path: Settings → Security and privacy → Privacy → Other privacy settings → Encryption certificates. The interface may vary depending on the manufacturer.

⚠️ Attention: The security settings interface is constantly updated by Google developers and smartphone manufacturers. If you cannot find the specified item, use the settings search by entering the word “certificate” or “trusted.”