How to delete installed certificates on Android: 5 proven methods

Android security certificates are digital “passports” that confirm the authenticity of sites, applications and networks. They protect your data from interception, but sometimes become a source of problems: they block access to corporate resources, cause connection errors, or simply take up space after VPN testing. Unlike iOS, where certificate management is strictly regulated, Android allows you to install and remove them manually - but it’s not always obvious how to do it correctly.

Not all certificates are created equal: user (installed by you manually) are deleted in a few clicks, and system (built into the firmware) require superuser rights or a factory reset settings. In this article, we will analyze both scenarios, and also consider hidden methods for experienced users - from ADB commands to editing system files. Important: deleting root certificates can disrupt the operation of banking applications and instant messengers that use encryption.

If you encounter an error NET::ERR_CERT_AUTHORITY_INVALID in your browser or an “Untrusted Certificate” warning in an application, most likely the problem lies in a digital signature conflict. This often happens after installing corporate profiles (for example, Microsoft Intune or VMware Workspace ONE), using custom VPNs, or manually importing certificates to bypass regional blocks. Before deleting everything, check which certificate is causing the problem - this will save time and prevent unnecessary manipulations with the system.

1. How to check the list of installed certificates

Before deleting certificates, you need to understand which of them are installed on the device. Android has two types of stores: user (for certificates added manually) and system (for built-in root CA certificates).

To view the list:

1. Open Settings → Security → Advanced → Encryption and credentials (the path may differ depending on the shell - MIUI, One UI, ColorOS).
2. Click on User certificates (or Installed certificates in older versions of Android).
3. System certificates are usually hidden - they can only be seen through Settings → System → About phone → Software version (click on "Build number" 7 times, then return to "Developer Settings" and turn on “View system certificates”)

In the list you will see the names of the certificates, their issuers (Issuer) and expiration date Pay attention to certificates with unfamiliar names or expired ones - they can be deleted without. risk for the system. If you see certificates from GlobalSign, DigiCert or Let’s Encrypt, you should not touch them - they are used by most legitimate sites.

2. user certificates through settings

This is the easiest and safest method that does not require root access or special knowledge. Suitable for manually installed certificates (for example, through files .crt or .p12).

Instructions:

• 📱 Go to Settings → Security → Encryption and credentials → User certificates.
• 🔍 Find an unnecessary certificate in the list and click on it.
• 🗑️ In the window that opens, select Delete (or Revoke in some firmware).
• 🔄 Confirm the action by entering the PIN code or pattern key of the device.

If the certificate is password protected (for example, .p12-file), the system will prompt you for it before deleting. After successful deletion, restart the device - some applications (for example, Outlook or Zoom) cache certificate data and may continue to generate errors until restarted.

⚠️ Attention: Some corporate applications (for example, Microsoft Authenticator or Cisco AnyConnect) automatically restore deleted certificates the next time you start them. To completely get rid of them, you will have to delete the application itself or reset its data in Settings → Applications.

3. Deleting system certificates without root access

System certificates (located in /system/etc/security/cacerts/) cannot be deleted using standard means - Android blocks changes in this folder. However, there are workarounds:

Method 1: Disabling via ADB (works on Android 9 and later):

adb shell pm uninstall -k --user 0 com.android.cts.priv.ctsshim
adb shell pm disable-user --user 0 com.android.cts.priv.ctsshim

These commands disable the certificate verification module for the current user. Minus: after a reboot or system update, the effect may disappear.

Method 2: Removal via Safe Mode (for certificates installed malware):

• 🔄 Press and hold the power button Turn off power until the prompt appears to go to Safe Mode.
• 🛡️ In safe mode, check the list of certificates - some of them may disappear (this is a sign that they were installed by third-party software).
• 🗑️ Remove suspicious applications through Settings → Applications.

4. Complete removal of certificates through a factory reset

If other methods did not help, there remains a radical method - factory reset settingsThis will delete all user certificates, accounts, applications and data. Warning: the method does not affect system certificates embedded in the firmware.

Step-by-step guide:

1. Create a backup copy of your data (photos, contacts, SMS) via Google Drive or Samsung Cloud.
2. Go to Settings → System → Reset settings → Delete all data.
3. Enter the PIN code and confirm the reset.
4. After rebooting, the device will be like new - all user certificates will disappear.

If you are using Samsung Knox, Huawei Mobile Services or other enterprise solutions, after the reset you may need to reactivate the device in the mobile device management (MDM) system. Check with your organization's administrator.

5. with root access

Advanced methods are available for advanced users with an unlocked bootloader and superuser rights. Attention: wrong actions can lead to bootloop (loop reboot) or loss of device functionality.

Method 1: Deleting certificate files

• 📂 Open a file manager with root support (for example, Root Explorer or Solid Explorer).
• 🔍 Go to /system/etc/security/cacerts/.
• 🗑️ Find files with the extension .0 (for example, a0d5d3a3.0) - these are the certificates. Delete unnecessary ones.
• 🔄 Change the folder permissions cacerts back on rwxr-xr-x (755).

Method 2: Using Magisk

If you have Magiskinstalled, you can use the module Disable Flag Secure or Universal SafetyNet Fixto bypass certificate verification without physically deleting them. This is useful for bypassing SafetyNet in banking applications.

⚠️ Attention: Removing system certificates Let’s Encrypt or Google Internet Authority may disrupt the operation of Google Play Services, Chrome and other services Before experiments, create a full backup via TWRP or OrangeFox Recovery.

6. How to recover deleted certificates

If, after deleting certificates, websites, VPNs or corporate applications stop working, you can restore them. Here's how to do it:

For user certificates:

• 📥 If you have saved the certificate file (.crt, .pem, .p12), simply install it again via Settings → Security → Install from memory.
• 🔄 If the certificate was associated with an application (for example, OpenVPN), reinstall this application - it can automatically restore the certificates.

For system certificates:

• 🔄 Reset the settings (if certificates were embedded in the firmware).
• 📦 Reflash the device to the original firmware via Odin (for Samsung) or Fastboot (for Pixel, Xiaomi etc.).
• 🛠️ Use custom recovery to restore a backup copy of the folder /system/etc/security.

If you deleted the corporate portal certificate (for example, Citrix Gateway or Pulse Secure), contact your company's IT department - they will provide a new file for installation or re-issue the certificate through the MDM system.

7. Common errors and how to avoid them

When working with certificates, users often encounter typical problems. Here are the most common ones and ways to solve them:

Error 1: "Could not delete certificate"

Cause: the certificate is protected by device policies (for example, Android Enterprise or Samsung Knox).

Solution: disable the device administrator in Settings → Security → Device administrators or perform a factory reset.

Error 2: After deleting certificates, banking applications do not work

Reason: the root certificate required for SafetyNet (for example, Google Play Services).

Solution: check the status SafetyNet through the app YASNAC and restore the certificates or use modules Magisk to bypass the check.

Error 3: Certificates appear again after a reboot

Cause: certificates are installed by a system application (for example Device Policy or Knox).

Solution: freeze the problematic application via Titanium Backup or disable it via ADB:

adb shell pm disable-user --user 0 com.sec.enterprise.knox.cloudmdm.mdm

FAQ: Answers to frequently asked questions

adb shell pm list packages -f | grep "cert"
adb shell pm uninstall -k --user 0 [package_name]