Certificate Injection — Android < 14
Part 3 of the Android Pentest series. For Android 14 and above the trust store moved under APEX — see Certificate Injection — Android 14+.
On Android 13 and earlier, the system trust store lives at
/system/etc/security/cacerts/ and can be written directly after a remount.
This is the simple case — no namespaces, no APEX.
Convert the BurpSuite certificate
Export the BurpSuite CA in DER format (Burp: Proxy → Options → Import/Export CA Certificate → Export Certificate in DER format), then convert and rename it:
# Convert DER to PEM
openssl x509 -inform der -in burp.der -out burp.pem
# Get the subject hash — this becomes the filename
HASH=$(openssl x509 -inform PEM -subject_hash_old -in burp.pem | head -1)
echo "$HASH"
# Rename to the hash-based filename Android expects
mv burp.pem "$HASH.0"
📌 The filename is not arbitrary. Android’s trust store looks up certificates by their subject hash. The format
<hash>.0must match or the certificate is silently ignored — no error, it just doesn’t work.
Push and install
# Remount /system as read-write
adb shell mount -o rw,remount /system
# Push the certificate
adb push "$HASH.0" /system/etc/security/cacerts/
# Fix ownership and permissions
adb shell chown root:root /system/etc/security/cacerts/"$HASH.0"
adb shell chmod 644 /system/etc/security/cacerts/"$HASH.0"
After pushing, reboot or restart the app to pick up the new cert. Verify it appears under Settings → Security → Trusted Credentials → System.
⚠️ If
mount -o rw,remount /systemfails with “Permission denied” or “Read-only file system”: some newer builds (even on Android < 14) use a read-only root or system-as-root. Fall back toinstall_cert.sh— its tmpfs overlay works regardless of the underlying mount. Note the tmpfs approach does not survive reboots; re-run after every restart.
Certificate operations reference
These OpenSSL commands come up constantly during mobile pentests — especially when extracting and comparing certificates pulled from app traffic.
DER (binary) → PEM (base64)
openssl x509 -in cert.der -inform der -outform pem -out cert.pem
Extract the RSA public key from a certificate
openssl x509 -in cert.pem -pubkey -noout > pubkey.pem
PEM public key → DER format
openssl rsa -pubin -inform pem -in pubkey.pem -outform der -out pubkey.der
Regenerate the public key from a private key
openssl rsa -in private.pem -pubout -out pubkey.pem
Inspect a certificate (subject, issuer, dates, SANs)
openssl x509 -in cert.pem -text -noout
Verify a certificate chain
openssl verify -CAfile ca.pem cert.pem
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
mount -o rw,remount /system fails | Read-only root / system-as-root | Use install_cert.sh (tmpfs overlay) |
| Cert pushed but not in Trusted Credentials | Filename doesn’t match subject hash | Recompute with -subject_hash_old, rename to <hash>.0 |
| Cert installed but HTTPS still fails | App pins specific certs | You also need SSL pinning bypass |
See also
- Previous: ADB & Frida Setup
- Next: Certificate Injection — Android 14+
- SSL Pinning Bypass — needed when cert install alone isn’t enough