How to remove certificates of certification authorities (CAs) on Android: a complete guide

Certificates of certification authorities (CAs) on Android are digital “trust seals” that confirm the authenticity of sites, applications and networks. They are automatically installed by the system, but sometimes users are faced with the need to remove them. The reasons can be different: from connection errors to Wi-Fi or VPN to warnings about “untrusted certificates” in the browser or banking applications. In some cases, unnecessary certificates even block access to corporate resources or interfere with work MITM proxy (for example, Charles Proxy or Fiddler).

In this article we will look at which certificates can be deleted without risk to the system, and which should not be touched. You will learn how to distinguish system certificates (installed by the manufacturer) from user (added manually or by applications), and also receive step-by-step guide for different versions Android - from Android 10 to the latest Android 15. We will pay special attention to potential problems: what. do if after deletion Google Play, WhatsApp or corporate mail stops working.

Why CA certificates can interfere with Android

CA certificates are designed to protect connections, but sometimes they become a source of problems. Here are the most common situations when their removal is justified:

• 🔒 SSL/TLS errors in the browser (Chrome, Firefox) or applications when visiting sites with a valid certificate. For example, the message “Your connection is not secure” (NET::ERR_CERT_AUTHORITY_INVALID).
• 📶 Wi-Fi problems: the device does not connect to the network with enterprise authentication (for example, in an office or university), although the login/password is correct.
• 🔄 Conflicts with VPN: applications like OpenVPN or WireGuard give errors like “Untrusted” server" (SSL handshake failed).
• 🏢 Blocking corporate resources: if a certificate from an old employer is installed on the device, a new one MDM profile (for example, Microsoft Intune) may refuse to work.
• 🛠️ Residual certificates after a reset: even after Hard Reset some CAs may remain in the partition /system, interfering with a clean installation of the software.

It is important to understand that not all certificates can be deleted without consequences. For example, system CAs from Google or Let’s Encrypt enable most HTTPS connections. Deleting them will lead to massive errors in the browser and applications. In the next section, we will learn to distinguish “safe” certificates from critical ones.

Which certificates can be deleted and which cannot

All certificates Android are divided into three categories:

System certificates (Comodo, DigiCert, GlobalSign etc.) cannot be deleted categorically - they are responsible for checking most HTTPS connections. Their absence will make the device practically unusable for the Internet. installed by you or applications (for example, FortiClient or Cisco AnyConnect), the exception is certificates required by your employer to access internal systems.

⚠️ Attention: On some devices (for example, Samsung Knox or Pixel with Titan M), deleting corporate certificates may lead to account blocking Google Workspace or Microsoft 365. Before deleting, check your organization's policies.

To check which certificate is causing the problem, use tool openssl (required root) or application Certificate Analyzer from Google PlayThey will show which CA is used to verify a specific site or network.

How to remove user CA certificates without root

If you do not have rights root, you can delete only those certificates that are installed in user storage. Here are step-by-step guide:

1. Open Settings → Security → Advanced → Encryption and credentials → User certificates (the path may vary depending on the version Android and shell).
2. In the list, find the certificate you want to delete. Focus on the name. data-i="120">) or publisher.for example, “Corp Wi-Fi CA”) or publisher.
3. Click on the certificate and select Delete. If the button is inactive, then the certificate is protected by a password or policy. MDM.
4. Confirm deletion. On some devices you will need to enter PIN code or pattern.

If the certificate is not displayed in the list, but you are sure that it is installed, try resetting network settings:

1. Go to Settings → System → Reset → Reset network settings.
2. Confirm the action. This will delete all saved networks. Wi-Fi, Bluetooth and VPN, as well as the certificates associated with them.

On devices with Android 12+ an additional step may be required: after removing the certificate reboot the device for the changes to take effect. If the problem persists, check whether the certificate is installed in application storage (more on this in the next section).

Removing certificates installed by applications (VPN, MDM)

Some applications (for example, OpenVPN, Fortinet, MobileIron) install their certificates in a secure storage. They cannot be deleted through standard settings, but can be deactivated or deleted along with the application.

Method 1: Removal through application settings

1. Open Settings → Applications → [VPN/MDM application name].
2. Go to section Storage → Delete data (or Clear cache).
3. Delete yourself application, if the certificate was part of it.

Method 2: Deactivate the certificate (for Android 10+)

1. Go to Settings → Security → Trusted Credentials.
2. Find the certificate associated with the application and disable slider Trust this certificate.

⚠️ Attention: On devices with Samsung Knox or Android Enterprise some certificates may be protected by policy Always On VPN. Deleting them will block access to corporate data. please consult with your IT department.

If the application is not uninstalled or the certificate remains active, try using ADB (instructions below). Also check if the certificate is installed in device profile (on Samsung This Settings → Biometrics and security → Other security settings → Credentials for work).

Removing certificates using ADB (for advanced users)

If standard methods do not work, you can use Android Debug Bridge (ADB). This method is suitable for removing certificates that are not displayed in the interface, but interfere with the operation of the system. You will need:

• 🖥️ A computer with ADB drivers installed and Platform Tools.
• 📱 Enabled USB debugging on your smartphone (Settings → About phone → Build number —press 7 times, then return to Settings → System → For developers → USB debugging).
• 🔐 Unlocked OEM Unlock (if required).

Instructions:

1. Connect the phone to the PC and run the command:
   

   adb devices

   Make sure the device is detected.

2. Get a list of all user certificates:
   

   adb shell pm list packages -f | grep -i cert

   Or directly:
   

   adb shell ls /data/misc/user/0/cacerts-added/

3. Remove the unnecessary certificate (replace HASH.0 with the real file name):
   

   adb shell rm /data/misc/user/0/cacerts-added/HASH.0

4. Reboot the device:
   

   adb reboot

To remove certificates installed by MDMsolutions (for example, Intune or VMware Workspace ONE), you may need to reset Device Admin:

adb shell dpm remove-active-admin [application_package]

⚠️ Attention: Incorrect use ADB can lead to data loss or device blocking. Do not delete files from /system/etc/security —this will lead to the smartphone being “bricked” (inoperable).

If, after deleting certificates via ADB there are problems with Google Play Services or SafetyNet, perform an integrity check:

adb shell su -c "settings put global hidden_api_policy 1"

What to do if after deleting certificates applications stopped working

Removing certificates can lead to unexpected consequences. Here are the most common problems and ways to solve them:

• 🌐 Sites do not work in the browser (ERR_CERT_AUTHORITY_INVALID):
  

  Install the missing certificate manually or reset the browser settings (Chrome → Settings → Reset settings).

• 📧 Corporate email does not connect (Outlook, Gmail):
  

  Delete and add the account again. If used Microsoft Authenticator, reactivation may be required.

• 🔐 Blocking Google Play or SafetyNet:
  

  Check the status through the app SafetyNet Test. If the test fails, do:
  

  adb shell su -c "rm -rf /data/data/com.google.android.gms/app_ssaid/*"

• 📶 Wi-Fi does not work with enterprise authentication:
  

  Delete the network from the saved ones and connect again, by selecting Do not check the certificate (if available).

If the problem persists, try reset security settings:

1. Go to Settings → System → Reset → Reset security settings.
2. Confirm the action. This will delete all certificates, passwords and biometric data.

On devices with Android 13+ after mass deletion of certificates, blocking protection may work. access to Play Protectblocking access to Google Play. To fix this:

1. Open Google Play Market.
2. Click on the profile icon → Play Protect → Settings (gear).
3. Disable Scanning your device for threats and restart your phone.

How to prevent automatic installation of unnecessary certificates

To avoid reappearance unnecessary certificates, follow these recommendations:

• 🛡️ Disable installation from unknown sources:
  Settings → Security → Unknown sources — disable permission for all applications.
• 📱 Check permissions applications:
  

  When installing VPN or MDMclients, read what certificates they add. For example, SuperVPN or TurboVPN often install their own CAs.

• 🔄 Regularly clean out your certificate store:
  

  Use apps like Certificates Monitor to track new CAs.

• 🏢 Configure your corporate devices correctly:
  

  If your phone was issued by your employer, ask your IT department to install the certificates via Android Enterprise with limited rights.

On Android 12+ you can block the installation of certificates via ADB:

adb shell settings put global install_non_market_apps 0

For devices with Samsung Knox or Pixel also recommended disable automatic trust of corporate certificates:

1. Go to Settings → Biometrics and security → Other security settings.
2. Disable the option Trust in corporate CAs (if available).

Common errors and how avoid them

When working with certificates, users often make critical errors that can lead to data loss or device blockingHere are the most common ones:

• 🚫 Removing system certificates via root:
  

  This leads to bootloop (loop loading) or massive SSL errors. You can only restore system CAs by flashing it.

• 🔄 Resetting settings without backup copies:
  

  Together with certificates, saved passwords Wi-Fi, application data and accounts will be deleted.

• 🔐 Ignoring warnings SafetyNet:
  

  Deleting certificates Google or Android Keystore can block Google Pay, Netflix other protected applications.

• 📱 Removing certificates on a work phone:
  

  On devices with Android Enterprise this can lead to remote blocking via MDM.

openssl s_client -connect example.com:443 -showcerts

adb shell pm uninstall -k --user 0 [application_package]