In today's digital world, the security of mobile devices becomes a critical task for every user. Smartphones store sensitive data, from banking passwords to personal communications, making them an attractive target for attackers. One of the most insidious threats is the introduction of third-party certificates of the certification authority (CA) certificates, which can be installed without the knowledge of the device owner.
Such certificates often enter the system through malware, phishing attacks, or even when installing legitimate applications that require access to encrypted traffic. The presence of a suspicious root certificate allows third parties to carry out MITM attacks (Man-in-the-Middle) by intercepting and decrypting your Internet traffic, including data from banking applications and instant messengers. In this article, we will look in detail at how to identify and remove unwanted certificates.
The procedure for clearing the credential store does not require root access, but requires care and understanding of the interface of your version of the operating system. We will look at standard paths for pure Android, as well as features of shells from Samsung, Xiaomi and Huawei. The correct configuration of trusted certification authorities is the foundation of the digital hygiene of your gadget.
Why do foreign certificates appear on the phone
Users are often surprised to find security certificates unknown to them in the system settings. Most often this happens when installing applications from untrusted sources that ask for the right to install trusted certificates for their operation. Some services, especially free VPNs or proxy clients, implement their own to filter traffic, which creates a security hole. Root certificates Another common scenario is the actions of malware that disguises itself as system updates or useful utilities. Attackers use certificates to spoof legitimate sites, redirecting the victim to phishing resources that are visually indistinguishable from the original. In this case, the browser does not issue connection error warnings, since the device “trusts” the fake certificate authority. root certificates to filter traffic, which creates a security hole.
Another common scenario is malware that disguises itself as system updates or useful utilities. Attackers use certificates to spoof legitimate sites, redirecting the victim to phishing resources that are visually indistinguishable from the original. In this case, the browser does not issue connection error warnings, since the device “trusts” the fake certificate authority.
Sometimes the cause is corporate security policies (MDM profiles) if the device is used for work purposes. Company administrators can remotely install certificates to control employee traffic. However, if you use your phone solely for personal needs, the presence of such profiles is a reason to immediately check and clean the system.
⚠️ Attention: If you find a certificate with a name containing the words "Proxy", "Filter", "AdBlock" or unknown abbreviations, and you did not intentionally install them for debugging, this is a sure sign that the security of the device has been compromised.
Search and identifying installed certificates
The first step to ensuring security is to audit the current state of the key store. The path to this section may vary slightly depending on the device manufacturer and Android version, but the logic remains the same. You need to find the section responsible for encryption and system credentials.
On devices with stock Android (Pixel, Motorola, Nokia) the path usually looks like this: go to Settings → Security → Encryption and Credentials. In some versions, this item may be simply called Credentials or located in the section Additional security settings. Here you will see an option to view trusted certificates.
For device owners Samsung with One shell UI navigation is a little different. Open Settings → Biometrics and security → Other security settings → Install from device (or View installed certificates). The interface may change, but the keywords "certificate" and "security" will help you find the section you need.
Inside the section you will see a list of installed root certificates certificates. Study it carefully. System certificates (for example, Google Trust Services, DigiCert, Let's Encrypt) do not need to be touched. You should be wary of:
- 🔍 Certificates with names that you do not recognize or that look like a bunch of random characters.
- 🛡️ Certificates issued by unknown organizations that are not related to large technology companies.
- 📅 Expired certificates actions that the system did not automatically delete for some reason.
Pay attention to the issue date and validity period of the certificate. If the certificate was issued recently, and you have not installed any new software at this time, this is a cause for concern.
Deleting user certificates on Android
The process of deleting user (manually installed) certificates is quite simple and does not require complex manipulations. However, it is important to act carefully so as not to accidentally disrupt the operation of legitimate applications that use corporate certificates (if there are any and you need them).
Once in the credential management menu, find the item Delete all credentials or Clear credentials. This feature is designed to reset all user certificates at once. When clicked, the system will ask you to confirm the action, and may also require you to enter a PIN code, pattern key or fingerprint to verify the owner.
If you want to delete a specific certificate, and not all at once, select it from the list. A detailed window will open with information about the owner, expiration date and key fingerprint. At the bottom of the screen or in the menu (three dots) there should be a button Delete or a trash can icon. Click it and confirm the action.
After deletion, it is recommended to restart the device so that the changes take effect and system services update the cache of trusted centers. This is a standard procedure that ensures that no background processes will use the remote key.
☑️ Security check
Features of removal on different versions of Android
The Android interface is constantly evolving, and the location of security settings may change from version to version. Starting with Android 11 and above, Google has tightened its security policies, making installing custom root certificates more complex, but also more transparent to manage.
In older versions, such as Android 8 or 9, the certificates section was often found in the menu Settings → Security → Device Administrators or next to the screen lock settings. If you are using an older device, be careful: the interface may be less intuitive.
Chinese manufacturers such as Xiaomi (MIUI/HyperOS) or Huawei (EMUI) move these settings deeper into the menu. In MIUI, the path may look like this: Settings → Passwords and security → Privacy → Special access → Access to certificates. In EMUI, look for the section Security → Advanced → Certificates.
Below is a table with example paths for popular shells, so that you can quickly navigate the settings of your device:
| Manufacturer / Shell | Path to settings | Interface features |
|---|---|---|
| Google Pixel (Stock) | Settings → Security → Encryption and credentials data | Minimalistic design, clear separation |
| Samsung (One UI) | Settings → Biometrics and security → Other options | Advanced settings, integration with Knox |
| Xiaomi (MIUI) | Settings → Passwords and security → Privacy | Multi-level menu, search required |
| Huawei (EMUI) | Settings → Security → Advanced | Strict menu hierarchy |
⚠️ Attention: The interfaces of mobile operating systems are frequently updated. If you don't find the specified path, search your phone settings for "certificate" or "credentials."
What if the delete button is grayed out?
If you can't delete a certificate, it may be installed as part of the device's administrator profile. In this case, you first need to delete the administrator profile itself in the "Device Administrator Applications" section, after which the certificate will become available for deletion.
Deleting device administrator profiles
Sometimes a certificate cannot be deleted in the standard way because it is blocked by administrator rights. This is a common situation with corporate software or certain types of ransomware viruses that block the ability to change security settings.
To solve this problem, go to Settings → Security → Device administrator applications (or Device administrators). Here you will see a list of applications that have advanced phone control rights. Find a suspicious application or profile that you did not install and uncheck it.
After deactivating administrator rights, the system will prompt you to confirm the action. Once the rights are revoked, you can return to the certificates section and safely delete unwanted entries. In rare cases, an application may resist removing rights - then try uninstalling the application itself through the standard app manager before revoking rights.
If a malicious application is hidden from the list or does not allow you to revoke rights, you may need to log in Safe Mode. To do this, you usually need to hold down the power button, and then long press the “Shut down” option on the screen until you are prompted to reboot into safe mode. In this mode, third-party applications do not launch, which will allow you to remove them.
Device administrator rights give applications deep access to the system. Always check this list at the first sign of strange phone behavior.
Resetting settings as a last resort
In situations where you cannot remove the certificate, or you suspect that hidden traces of malware remain on the system, the most reliable solution is to completely reset the device to factory settings. This is a drastic but effective method that is guaranteed to clear the user certificate store.
Before performing a reset, be sure to back up your important data: photos, contacts and documents. Remember that all installed applications and their data will be deleted. Go to Settings → System → Reset settings → Delete all data (factory reset).
After rebooting, the phone will be in the “out of the box” state. All user certificates will be destroyed. When setting up for the first time, be extremely careful: do not restore a backup copy of applications immediately if you suspect that a virus may have been stored in the backup. It is better to reinstall the applications from the official store.
This method also solves problems with incorrect Internet operation if the cause was conflicts in network settings and substituted certificates. A clean installation of the OS eliminates any software errors accumulated during the use of the device.
⚠️ Attention: A full reset deletes absolutely all data from the phone’s internal memory. Make sure that you have saved important files to your computer or cloud storage before starting the procedure.
Prevention and protection against re-infection
After successfully deleting certificates, it is important to take measures to prevent the situation from happening again. The main reason for the appearance of malicious CAs is the installation of software from untrusted sources. Try to download applications only from the official store Google Play or Galaxy Storewhere the automatic security check system works.
Regularly check the list of installed applications and remove those that you do not use. Pay attention to the permissions that apps ask for: if a simple flashlight asks for network access or administrator rights, this is a clear sign of malware. Use antivirus solutions from reputable vendors to periodically scan your system.
You should also avoid connecting to open and unreliable Wi-Fi networks, especially in public places. Attackers can use such networks to inject certificates into user traffic. If connecting to a public network is necessary, use proven paid VPN services that do not require installing your own root certificates.
Is it possible to block the installation of certificates forever?
On standard devices without root access, it is impossible to completely block the installation of user certificates, since this is a system function. However, you can minimize the risks by not clicking “Install” in the system dialogs that appear unless absolutely necessary.
What happens if I delete the system certificate by mistake?
Removing the system certificate (the one that was pre-installed by the manufacturer) may cause some sites or applications to stop opening, giving a connection error. Usually the system does not allow you to delete built-in certificates without root access. If this happens, a factory reset will help, which will restore the original set of certificates.
Why does the browser write “The connection is not secure” after deletion?
This may mean that you have deleted a certificate necessary for the operation of a corporate network or a specific application. If the problem occurs on all sites, check the date and time on the device - incorrect times also cause certificate errors. If only on one resource, perhaps its certificate is actually revoked or invalid.
How to check whether a virus remains after deleting a certificate?
A certificate is just a tool. If it was installed by a virus, the virus itself may remain on the system. Scan your phone with an antivirus (for example, Dr.Web or Kaspersky). Also check the list of applications for unknown apps and look at the battery consumption in the settings - viruses often cause abnormal discharge.
Do you need to delete certificates when selling your phone?
Yes, this is a mandatory procedure. Before transferring the device to the new owner, you must perform a full factory reset. This will delete all your personal data, accounts and installed user certificates, ensuring the confidentiality of your information.
Can a certificate affect Internet speed?
The certificate itself does not affect the speed. However, if traffic is redirected through an attacker's proxy server using a spoofed certificate, the speed can drop significantly due to delays on a third-party server or the attacker's bandwidth limitations.