通過 ADB 安裝用戶證書

Question

有沒有辦法通過 ADB 在“ Security -> Trusted Credential -> User tab下安裝 CA 證書（ .crt文件）？ 或任何其他“可編寫腳本”的方式。

Answer 1

我想出了一種方法來做到這一點，因此我能夠信任查爾斯代理證書。 它將被添加為受信任的 SSL 根證書。

首先你需要得到證書哈希

openssl x509 -inform PEM -subject_hash_old -in charles-proxy-ssl-proxying-certificate.pem | head -1>hashedCertFile

我使用 Windows，將其存儲在 var 中以自動執行該過程

set /p certHash=<hashedCertFile
    

set certHash=%certHash%.0 && DEL toto
cat charles-proxy-ssl-proxying-certificate.pem > %certHash%

openssl x509 -inform PEM -text -in charles-proxy-ssl-proxying-certificate.pem -out nul >> %certHash%

adb shell mount -o rw,remount,rw /system

adb push %certHash% /system/etc/security/cacerts/

adb shell mount -o ro,remount,ro /system

adb reboot

這是從這個答案復制的 unix 版本：

PEM_FILE_NAME=logger-charles-cert.pem
hash=$(openssl x509 -inform PEM -subject_hash_old -in $PEM_FILE_NAME | head -1)
OUT_FILE_NAME="$hash.0"

cp $PEM_FILE_NAME $OUT_FILE_NAME
openssl x509 -inform PEM -text -in $PEM_FILE_NAME -out /dev/null >> $OUT_FILE_NAME

echo "Saved to $OUT_FILE_NAME"
adb shell mount -o rw,remount,rw /system
adb push $OUT_FILE_NAME /system/etc/security/cacerts/
adb shell mount -o ro,remount,ro /system
adb reboot

Answer 2

感謝這個答案Install User Certificate Via ADB我能夠修改一個在 bash shell 上運行的腳本：

PEM_FILE_NAME=logger-charles-cert.pem
hash=$(openssl x509 -inform PEM -subject_hash_old -in $PEM_FILE_NAME | head -1)
OUT_FILE_NAME="$hash.0"

cp $PEM_FILE_NAME $OUT_FILE_NAME
openssl x509 -inform PEM -text -in $PEM_FILE_NAME -out /dev/null >> $OUT_FILE_NAME

echo "Saved to $OUT_FILE_NAME"
adb shell mount -o rw,remount,rw /system
adb push $OUT_FILE_NAME /system/etc/security/cacerts/
adb shell mount -o ro,remount,ro /system
adb reboot

（是的，我知道這可能是一條評論，但我還沒有足夠的聲譽將其作為評論發布）

Answer 3

我能夠通過以下步驟獲得服務器證書以顯示在“ Trusted Credential -> User ”選項卡（而不是其他答案顯示的“系統”選項卡）下：

#!/bin/bash
subjectHash=`openssl x509 -inform PEM -subject_hash_old -in server.crt | head -n 1`
openssl x509 -in server.crt -inform PEM -outform DER -out $subjectHash.0
adb root
adb push ./$subjectHash.0 /data/misc/user/0/cacerts-added/$subjectHash.0
adb shell "su 0 chmod 644 /data/misc/user/0/cacerts-added/$subjectHash.0"
adb reboot

Answer 4

2022 ：httptoolkit 有一個很好的解決方案，可以在不重新啟動到 root 設備/模擬器的情況下注入自定義證書

詳情在這里： https ://httptoolkit.tech/blog/intercepting-android-https/#injecting-ca-certificates-into-rooted-devices

    set -e # Fail on error
    # Create a separate temp directory, to hold the current certificates
    # Without this, when we add the mount we can't read the current certs anymore.

    mkdir -m 700 /data/local/tmp/htk-ca-copy
    # Copy out the existing certificates

    cp /system/etc/security/cacerts/* /data/local/tmp/htk-ca-copy/
    # Create the in-memory mount on top of the system certs folder

    mount -t tmpfs tmpfs /system/etc/security/cacerts
    # Copy the existing certs back into the tmpfs mount, so we keep trusting them

    mv /data/local/tmp/htk-ca-copy/* /system/etc/security/cacerts/
    # Copy our new cert in, so we trust that too

    mv ${certificatePath} /system/etc/security/cacerts/
    # Update the perms & selinux context labels, so everything is as readable as before

    chown root:root /system/etc/security/cacerts/*
    chmod 644 /system/etc/security/cacerts/*
    chcon u:object_r:system_file:s0 /system/etc/security/cacerts/*
    # Delete the temp cert directory & this script itself

    rm -r /data/local/tmp/htk-ca-copy
    rm ${injectionScriptPath}
    echo "System cert successfully injected"

資源

Answer 5

將文件推送到設備

adb push "C:\path\cacert.cer" "/data/local"

啟動證書安裝程序

adb shell am start -n com.android.certinstaller/.CertInstallerMain -a android.intent.action.VIEW -t application/x-x509-ca-cert -d file:///data/local/cacert.cer

現在完成安裝，提示將出現在您的設備上。

Answer 6

就我而言，我首先需要將模擬器啟動為可寫：

adb start-server
emulator -writable-system -avd Pixel_2_API_24

然后你可以安裝證書：

adb root
adb remount
adb push c8750f0d.0 /system/etc/security/cacerts

https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android

Answer 7

這只會在非根用戶 android 上啟動“你想信任這個證書窗口嗎”。這是 @hoghart45 的答案，除了一行確保你有權將證書粘貼到/data/local/..目錄：

certificateName=ca.crt
ca_dir_in_phone="/data/local/tmp/try3"
ca_path_in_phone="$ca_dir_in_phone/$certificateName"

adb shell mkdir -m 700 "$ca_dir_in_phone"
adb push "$certificateName" "$ca_path_in_phone"

adb shell am start -n com.android.certinstaller/.CertInstallerMain -a android.intent.action.VIEW -t application/x-x509-ca-cert -d file://"$ca_path_in_phone"

為了完整起見，這里有一個 WIP Python 項目 WIP，它還使用uiautomator以受控方式自動單擊“確定”。 （它在單擊之前驗證它是 ok 按鈕，它不只是發送盲輸入，如send keyevent 20命令）。 免責聲明，我參與了那個項目。