-
Notifications
You must be signed in to change notification settings - Fork 0
Certificates and Keys
This section provides more information about the authentication used in Android Auto, and why certificates and keys are sometimes necessary, and sometimes not necessary to use Flywheel.
If you already know or don't care, skip to the what to do about it section.
Android Auto implements authentication as a part of the connection's SSL/TLS handshake. SSL/TLS is same technology used to encrypt and verify the authenticity of websites you connect to using HTTPS.
During the SSL/TLS handshake, both the phone and headunit present each other a certificate. These certificates are supposed to be endorsed by Google and match the associated private key. If they aren't (and if the headunit or phone actually check this), the connection fails and you get a message like "this headunit failed security checks" or "please check your date and time".
Since the certificate must be endorsed by Google and the private key must be endorsed by the certificate, I cannot generate a certificate and private key to be included in Flywheel. As such, these certificates and keys must be extracted from the Android Auto app.
Typically DIY, emulated, and aftermarket headunit implementations (which are not Google certified) don't actually have a reason to require a Google endorsed certificate, so they don't. In these cases, you can use Flywheel's self-signed keys without issue, and don't need to extract or import anything.
Official, OEM, and certified aftermarket headunits may not be so nice.
The most frustrating part about this situation is that the certificates expire a few months after they're issued. When Google releases a new version of Android Auto, they generate a new private key and certificate.
The certificate has a specific period of validity, usually starting at Jul 4, 2014 and ending a few months after the Android Auto update is released. If you've ever had an old version of Android Auto stop working until you update, this is probably why.
Tip
It is advisable to try Flywheel without setting up a custom key/certificate pair first.
If that doesn't work, you may need to follow this section.
To extract keys from the Android Auto app, you can use KeyXposer.
Since KeyXposer requires a rooted phone with Google services installed, it may not be a good solution for everyone. Hopefully more accessible solutions are available in the future.
Note
If you exported a bundle from KeyXposer, you can skip to Importing the bundle.
If you have a PEM encoded private key and certificate as separate files, you can use a text editor to create the bundle. PEM files are just normal text files with base64 encoded blocks.
Flywheel expects the PEM bundle to contain:
- a single PKCS#8 encoded private RSA key
- one or more X.509 encoded certificates
- the first X.509 certificate in the file must have a public key matching the included private key (usually it has "O=CarService" in the subject)
The bundle should be formatted like:
-----BEGIN PRIVATE KEY-----
(base64 encoded data)
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
(base64 encoded data)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(base64 encoded data)
-----END CERTIFICATE-----
Usually there are only 1 or 2 certificates, with the first belonging to "CarService", and the optional second belonging to "Google-Automotive-Link".
- Expand the 3 dot menu and go to [Settings > Certificates and keys]
- Import PEM encoded certificate and private key bundle
- Make sure the "Use Imported Keys" switch is enabled
As mentioned in a previous section, extracted certificates are only valid for a few months after the date of the Android Auto release they were extracted from.
Thankfully, if your headunit allows adjusting the date, you may have an easy way around this. The certificates are usually valid from July 4, 2014 and onward, so you just have to adjust the year to be 2015 (or as close as you can get).
If your headunit does not let you adjust the date or still rejects the the expired certificates, you will have to extract new certificates and keys every few months to use Flywheel on your headunit. Alternatively, you could install an aftermarket headunit which doesn't verify certificates or allows changing the date.
Some wireless adapters may allow you to effectively bypass this requirement if they provide their own certificates/keys for the headunit connection.
One such example is the AAWireless adapter with passthrough mode disabled.
Please note that since real keys from the Android Auto app are only valid for a few months after creation, these adapters may try to use headunit keys instead, which might not work with your car. (The AAWireless adapter does, for example).