-
Notifications
You must be signed in to change notification settings - Fork 0
Certificates and Keys
Tip
It is advisable to try Flywheel without setting up a custom key/certificate pair first.
If that doesn't work, you may need to follow this section.
This section provides more information about the authentication used in Android Auto, and why certificates and keys are sometimes necessary, and sometimes not necessary to use Flywheel.
If you already know or don't care, skip to the what to do about it section.
Android Auto implements authentication as a part of the connection's SSL/TLS handshake. SSL/TLS is same technology used to encrypt and verify the authenticity of websites you connect to using HTTPS.
During the SSL/TLS handshake, both the phone and headunit present each other a certificate. These certificates are supposed to be endorsed by Google and match the associated private key. If they aren't (and if the headunit or phone actually check this), the connection fails and you get a message like "this headunit failed security checks" or "please check your date and time".
Since the certificate must be endorsed by Google and the private key must be endorsed by the certificate, I cannot generate a certificate and private key to be included in Flywheel. As such, these certificates and keys must be extracted from the Android Auto app.
Typically DIY, emulated, and aftermarket headunit implementations (which are not Google certified) don't actually have a reason to require a Google endorsed certificate, so they don't. In fact, it may be explicitly avoided, as doing so would require including Google's automotive link certificate in the software. In these cases, you can use Flywheel's self-signed keys without issue, and don't need to extract or import anything.
Official, OEM, and certified aftermarket headunits may not be so nice.
The most frustrating part about this situation is that the certificates expire a few months after they're issued. When Google releases a new version of Android Auto, they generate a new private key and certificate.
The certificate has a specific period of validity, usually starting at Jul 4, 2014 and ending a few months after the Android Auto update is released. If you've ever had an old version of Android Auto stop working until you update, this is probably why.
Instructions for this are not yet available in this repository, but there are multiple ways to go about it if you know what you're doing.
You may also be able to find working (but usually expired) Android Auto app key/certificate pairs from elsewhere on the Internet. These can work, but you might have to set the clock back on your headunit to before they expired. Flywheel will tell you if an imported certificate is expired.
- Expand the 3 dot menu and go to [Settings > Keys and Certificates]
- Import PEM encoded X509 certificate (or chain) and matching PKCS8 private key through file picker
- Enable the "Use Imported Keys" switch
Some wireless adapters may allow you to effectively bypass this requirement if they provide their own certificates/keys for the headunit connection.
One such example is the AAWireless adapter with passthrough mode disabled.
Please note that real keys from the Android Auto app are only valid for a few months after creation, so these adapters may try to use headunit keys instead, which might not work with your car. (The AAWireless adapter does, for example).