Which certificates can be safely removed from Android: full analysis + instructions

Android certificates are digital “passports of trust” that confirm the authenticity of sites, applications and networks. They provide data encryption during transmission (for example, in HTTPS-connections) and app authentication. However, over time, their list grows: corporate certificates from employers, test keys for applications, outdated root centers (CA) are installed. Some of them not only take up space, but also create security vulnerabilities security vulnerabilities - for example, if an attacker gains access to the private key of a compromised certificate.

But deleting certificates at random is dangerous: without system root certificates (Let's Encrypt, DigiCert, GlobalSign) they will no longer open sites, and without custom ones, corporate applications may break (for example, Microsoft Outlook or VMware Workspace ONE). In this article we will look at which certificates can be deleted without consequenceswhich ones should not be touched. We will also give step-by-step guide for different versions of Android and popular brands - from Samsung Knox to MIUI.

⚠️ Warning: Deleting system certificates requires rights root and can lead to the device not working. For custom certificates (installed manually or by corporate policies), standard rights are sufficient.

If you are not sure about the purpose of the certificate - do not delete it. It's better to first export the backup via Settings → Security → Advanced → Encryption and Credentials → User Certificates.

1. Types of certificates on Android: what they are and what they are responsible for

All certificates on Android are divided into three main categories, each of which has its own level of criticality for the system:

System certificates (System CA) - built into the firmware by the manufacturer. They sign verified certification authorities (CA), such as Google Trust Services, VeriSign or GoDaddy. It is impossible to delete them without rootrights, and with rights it is extremely risky. For example, without a certificate Android CA updates through Google Play.

User certificates are installed manually (for example, for access to a corporate network) or automatically (through applications like FortiClient or Cisco AnyConnect). They can be deleted without consequences if they are no longer needed. An exception is certificates tied to device management (for example, MDMsolutions from the employer).

Application certificates - are used by individual apps for authentication (for example WhatsApp or banking applications). There is no point in deleting them - they are restored the next time the application is launched.

🔍 How to distinguish a system certificate from a user one?

System certificates are displayed in the menu Settings → Security → Trust → System certificates and do not have a delete button. User - in the section User certificates with the ability to delete.

2. What certificates can be deleted without risk

It is safe to delete only User certificatesthat you installed yourself or that were added through third-party applications. Here is a list of typical candidates for removal:

• 🏢 Corporate certificates —if you no longer work for the company that installed them (for example, CompanyName Root CA or Enterprise Wi-Fi Certificate).
• 🔧 Test/development certificates —often installed when debugging applications via Android Studio (for example, debug.keystore).
• 🌐 Certificates of VPN providers - if you stopped using the services NordVPN, ProtonVPN or similar services.
• 📱 Certificates from outdated applications —for example, from remote instant messengers or banking apps (if you haven’t used them for a long time).

⚠️ Attention: If a certificate is installed via Device Management (MDM), deleting it can block access to corporate resources or even reset the device to factory settings (on some Samsung Knoxdevices).

Critical: Never delete certificates named Android, Google, Let's Encrypt or DST Root CA X3 —they are responsible for the operation of HTTPS and system services.

3. Step-by-step guide: how to delete certificates on different versions of Android

Process removal depends on the version Android and the manufacturer's shell. Below are instructions for the most common cases.

Android 10–14 (pure Android, Google Pixel, Motorola)

1. Open Settings → Security.
2. Select Advanced → Encryption and Credentials.
3. Go to User Certificates.
4. Click on the certificate and select Delete.

Samsung One UI (Galaxy S23, A54, etc.)

1. Go to Settings → Biometrics and security.
2. Select Other security settings → Credentials and encryption.
3. Click User certificates and delete unnecessary ones.

⚠️ On devices c Samsung Knox some certificates may be protected by policies. Removing them will require resetting Knox via Settings → General → Reset → Reset Knox.

Xiaomi MIUI (Redmi, POCO, Mi)

1. Go to Settings → Passwords and security.
2. Select Privacy → Trust → User certificates.
3. Remove unnecessary certificates (in MIUI you may need to enter password).

📌 For devices with root access:

If you need to delete the system certificate, use Root Explorer or ADB:

adb shell
su
mount -o rw,remount /system
rm /system/etc/security/cacerts/CERTIFICATE_NAME.0
mount -o ro,remount /system

4. Certificates that absolutely cannot be deleted

Some certificates are critical for the operation of the system. Deleting them will lead to errors when connecting to Wi-Fi and the impossibility of updating. applications or even to device brick (loss of performance). Here is the complete list of “untouchables”:

⚠️ Attention: On some devices (for example, Huawei or Honor s HMS), deleting certificates Huawei Root CA may block access to branded services, including AppGallery.

🔎 How to check if the certificate is a system one?

System certificates are stored in the folder /system/etc/security/cacerts/ and have the extension .0 or .crt. Custom - in /data/misc/user/0/cacerts-added/.

5. How to recover a deleted certificate

If you accidentally deleted an important certificate, there are several ways to restore it:

Method 1: Reset network settings

Sometimes resetting network settings helps (Settings → System → Reset → Reset Wi-Fi, Mobile Network and Bluetooth). This will restore the certificates associated with the connections.

Method 2: Reinstall via .crt or .p12 file

If you have a backup certificate (file with extension .crt, .p12 or .pfx), it can be reinstalled:

1. Copy the file to the device.
2. Open it via Files or Explorer.
3. Follow the installation wizard instructions (a password may be required).

Method 3: Firmware update

On some devices (for example, Samsung or Xiaomi) system certificates are restored after updating the software via Settings → Software update.

Method 4: Manual addition via ADB

For experienced users:

adb install-burger certificate.crt

(requires root or an unlocked bootloader).

⚠️ If the certificate was part MDM policies, its restoration may require re-registration of the device in the corporate system.

6. Common mistakes when working with certificates and how to avoid them

Many users encounter problems after incorrectly deleting certificates. Here are the most common errors and their solutions:

• 🚫 Error: "No Internet connection" after deletion certificate
  Cause: The root certificate (Let's Encrypt, DigiCert) responsible for HTTPS has been deleted.
  Solution: Reset network settings or reinstall the certificate manually.
• 🔒 Error: "This connection is not private" in Chrome
  Cause: There is no trusted certificate for the site (for example, after deleting GlobalSign).
  Solution: Add the certificate back or use another browser (for example, Firefoxthat has its own storage certificates).
• 📱 Error: "The application is not installed" when updating apps
  Cause: The certificate that signed updates has been removed Google Play.
  Solution: Reboot the device or wipe cache Google Play Market.
• 🏢 Error: "The device does not comply with the security policy" (on a work phone)
  Cause: Deleted corporate certificate, required MDM.
  Solution: Contact the company's IT department to re-register.

💡 Tip: Before mass deletion of certificates, check them for use with the command:

adb shell dumpsys package | grep "cert"

This command will show which applications are actively using certain certificates.

7. Certificates for Android: myths and reality

There are a lot of rumors around certificates for Android. Let's look at the most popular ones:

Myth 1: "Deleting certificates will speed up the phone"
Reality: Certificates take up a small amount of memory (usually a few kilobytes per piece). Deleting them will not affect performance, but can create security problems.

Myth 2: “All user certificates can be deleted without consequences”
Reality: Some user certificates are tied to VPN, Wi-Fi or MDM. Deleting them can disrupt the operation of networks or corporate applications.

Myth 3: “Certificates are only needed for HTTPS sites”
Reality: They are also used for application authentication (for example, during installation APK), email encryption (S/MIME) and even for some functions Android Work Profile.

Myth 4: “On Android 12+, certificates do not affect security.”
Reality: On the contrary, in new versions of Android, certificates play an even greater role due to the tightening of policies Scoped Storage and Privacy SandboxFor example, without correct certificates WebViewtabs will not work. applications.

⚠️ Attention: On devices with Android Enterprise (for example, corporate phones), an attempt to remove certificates may lead to an automatic reset of the device to factory settings. This is part. security policies Google for managed devices.

FAQ: Frequently asked questions about certificates on Android

adb uninstall-certificate "CERTIFICATE_NAME"

adb shell pm list packages -f | grep "cert"