crypto/x509: incorrect user trust store directory is used for Android

[chenxiaolong]

In #58922, the following user trust store directory was added to crypto/x509 for Android:

go/src/crypto/x509/root_linux.go

Line 29 in 6da1601

"/data/misc/keychain/certs-added", // User trusted CA folder

However, Android hasn't used this path since 2014 and instead uses /data/misc/user/<user ID>/cacerts-added, where <user ID> is the Android user ID (not Linux/POSIX UID).

I'm not sure if there's a good public API to get the user ID. UserHandle.myUserId() (on the Java side) is not public. However, the Android user ID is implemented as getuid() / 100000. As far as I can tell, this has never changed since Android got multi-user support ~14 years ago. Maybe it's good enough to rely on this implementation detail?

Some links:

• https://android.googlesource.com/platform/frameworks/base/+/refs/tags/android-15.0.0_r12/core/java/android/security/net/config/UserCertificateSource.java#34
  • This is where Android loads /data/misc/user/<user ID>/cacerts-added for the Java TLS stack
• https://android.googlesource.com/platform/frameworks/native/+/07053fcb61436221fac2281394e98ec9d0feab3d%5E%21/
  • This is the commit when Android migrated away from the old /data/misc/keychain/certs-added directory

---

Side note: For system CA certs, golang currently only loads /system/etc/security/cacerts, but ever since Android 14, the system CA certs became updatable and /apex/com.android.conscrypt/cacerts should have priority: https://android.googlesource.com/platform/frameworks/base/+/refs/tags/android-15.0.0_r12/core/java/android/security/net/config/SystemCertificateSource.java#48

[gabyhelp]

Related Issues

• crypto/x509: add android user trusted CA folder as a possible source for certificate retrieval #58922 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[chenxiaolong]

Hmm, there's another potential issue. The system and apex directories contain PEM-encoded certificates, but Android writes DER-encoded certificates to the user directory (regardless of what the original format was during import).

[ianlancetaylor]

CC @golang/security @golang/android

[dyhkwong]

Even if on Android version 4.x, the user trusted CA path is /data/misc/keychain/cacerts-added, not /data/misc/keychain/certs-added. PR #50240 just does not work regardless of Android version. Did /data/misc/keychain/certs-added ever exist?

[chenxiaolong]

Even if on Android version 4.x, the user trusted CA path is /data/misc/keychain/cacerts-added, not /data/misc/keychain/certs-added. PR #50240 just does not work regardless of Android version. Did /data/misc/keychain/certs-added ever exist?

Oh, good catch. Yeah, I don't think that path worked in any version of Android.