Android

We are often asked which certificate is compatible with Android? There is no simple answer.

To check a root compatibility with an Android version, you will need to look it up in the source code:

For versions prior to Android Lollipop (5.0):
Tag list from the repository
You will need to look for the version you want, i.e. the tag kitkat-release, then go in the luni/src/main/files/cacerts directory. The cacert directory contains all root certificates and their metadata.

From Android Lollipop (5.0):
Tag list from the repository
You will need to look for the version you want, i.e. the tag pie-release and then go to the file directory that will contain all root certificates and their metadata.

But be carefull:

• it does not specify which version of Android with which version of the file
• Some smartphone resellers deliver a reduced version of the certificates database meaning that you can possibly have a N verion of Android but a N-x version of the cacerts.bks file

Through experience we noticed that the more Android-compatible certificates are the Sectigo SSL and the GlobalSign OrganizationSSL, or for the Unified Communication standard the Sectigo UCC and the GlobalSign UCC certificates.

External links:

• List of CA existing in the Android trunk in September 9th, 2010
• http://groups.google.com/group/android-security-discuss/browse_thread/thread/11f502ccd41ff5d3
• http://code.google.com/p/android/issues/detail?id=1016