crypto/x509: add android user trusted CA folder as a possible source for certificate retrieval

[odeke-em]

For the purposes of getting what looks like a simple cryptography related change expediently but carefully reviewed and approved, I am coming here from @jbpin's CL https://go-review.googlesource.com/c/go/+/473035 and PR #50240, a new contributor sent a change adding the Android User Trusted Certificate Authority folder as a source of certificates. This change is to invite experts to comment and approve if we should support /data/misc/keychain/certs-added as a source of certificates

Kindly cc-ing @rolandshoemaker @FiloSottile

[ianlancetaylor]

CC @golang/security

[rsc]

This proposal has been added to the active column of the proposals project
and will now be reviewed at the weekly proposal review meetings.
— rsc for the proposal review group

[rsc]

The proposal is to read Android certs both from the system cert directory and what is apparently the user cert directory (/data/misc/keychain/certs-added). This seems reasonable and aligns with reading user-installed certs on Mac and Windows, which we do by querying the operating system for certs. Is there a user-installed cert directory on Linux too? If so should we add that?

/cc @FiloSottile @rolandshoemaker

[rsc]

Given the similarity to Mac and Windows it sounds like we can accept this for Android.
There is a question of whether there's a non-root-owned user-specific cert place on Linux, but if so that can be a separate proposal.

[rolandshoemaker]

Seems reasonable, ideally there would be a uniform place to look/API we could use, but that is wishful thinking. At some point the list of places we might slurp certs from is going to become unwieldy, but I'm not sure we are there yet.

[rsc]

Based on the discussion above, this proposal seems like a likely accept.
— rsc for the proposal review group