首頁 > 軟體

Android證書安裝過程介紹

2021-12-08 19:01:21

一.證書在原始碼中的路徑

5.1系統證書(命名是 openssl x509 -subject_hash_old -in filename)

libcore/luni/src/main/files/cacerts

7.1及以後系統證書

/system/ca-certificates/files

二.證書在韌體中的路徑

/system/etc/security/cacerts

三.手動安裝流程

設定-->安全-->從SD卡安裝證書:

在AndroidManif.xml裡

<Preference android:key="credentials_install"
        android:title="@string/credentials_install"
        android:summary="@string/credentials_install_summary"
        android:persistent="false">
    <intent android:action="android.credentials.INSTALL"
            android:targetPackage="com.android.certinstaller"
            android:targetClass="com.android.certinstaller.CertInstallerMain"/>
</Preference>

packages/apps/CertInstaller

CertInstallerMain開啟Document,選擇證書檔案,選擇好後。啟動CerInstaller

然後根據證書型別區分createPkcs12PasswordDialog和createNameCredentialDialog,看個簡單的createNameCredentialDialog

try {
    startActivityForResult(
            mCredentials.createSystemInstallIntent(),   //Intent intent = new Intent("com.android.credentials.INSTALL");
            REQUEST_SYSTEM_INSTALL_CODE);
} catch (ActivityNotFoundException e) {
    Log.w(TAG, "systemInstall(): " + e);
    toastErrorAndFinish(R.string.cert_not_saved);
}

看intent,又到了Settings的CredentialStorage

Settings/src/com/android/settings/CredentialStorage.java    installIfAvailable

新增證書:Settings/src/com/android/settings/CredentialStorage.java    installIfAvailable()

刪除證書:Settings/src/com/android/settings/TrustedCredentialsSettings.java   AliasOperation#doInBackground

顯示證書:Settings/src/com/android/settings/TrustedCredentialsSettings.java   AdapterData#AliasLoader#doInBackground   

證書內容:Settings/src/com/android/settings/TrustedCredentialsSettings.java  CertHolder  SslCertificate

安裝型別兩種: userKey和Ca證書(pk12要處理密碼)

CertInstallersrccomandroidcertinstallerCredentialHelper.java

異常碼:

機器未設定密碼鎖

機器未解鎖

鎖屏方式不符合要求還是packages/apps/CertInstaller/CertInstallerMain,startActivityForResult結果回撥

if (requestCode == REQUEST_SYSTEM_INSTALL_CODE) {
    if (resultCode == RESULT_OK) {
        Log.d(TAG, "credential is added: " + mCredentials.getName());
        Toast.makeText(this, getString(R.string.cert_is_added,
                mCredentials.getName()), Toast.LENGTH_LONG).show();
 
        if (mCredentials.hasCaCerts()) {
            // more work to do, don't finish just yet
            new InstallCaCertsToKeyChainTask().execute();
            return;
        }
        setResult(RESULT_OK);
    } else {
        Log.d(TAG, "credential not saved, err: " + resultCode);
        toastErrorAndFinish(R.string.cert_not_saved);
    }
}

如果是CaCerts,還要進行 new InstallCaCertsToKeyChainTask().execute() --> mCredentials.installCaCertsToKeyChain --> keyChainService.installCaCertificate

keyChainService實現在packages/apps/KeyChain  mTrustedCertificateStore.installCertificate

external/conscrypt/src/platform/java/org/conscrypt/TrustedCertificateStore   installCertificate --> writeCertificate

四.c層

system/security/keystore/keystore.cpp

新增證書  installIfAvailable -> mKeyStore.put -> mBinder.insert (這裡還是java層)
-> KeyStoreProxy::insert -> KeyStore::put  (這裡getEncryptionKey用到一個AESkey,哪裡來的?)

五.為什麼要鎖屏密碼

以設定密碼為例
Settings/src/com/android/settings/ChooseLockPassword.java  mLockPatternUtils.saveLockPassword
frameworks/base/core/java/com/android/internal/widget/LockPatternUtils.java  getLockSettings().setLockPassword
frameworks/base/services/core/java/com/android/server/LockSettingsService.java  setLockPassword -> maybeUpdateKeystore  -> ks.passwordUid
-> 到keystore.cpp的password_uid 

password_uid 有三種狀態,其中STATE_UNINITIALIZED和STATE_LOCKED都會呼叫setupMasterKeys,經鎖屏密碼設定AESkey
這裡就解答了新增證書時的AESKey是哪來的

這個是基於Android5.1分析的,高版本可能檔名不同,但是知道大概位置,搜尋下,應該沒什麼難度        

到此這篇關於Android證書安裝過程介紹的文章就介紹到這了,更多相關Android證書安裝內容請搜尋it145.com以前的文章或繼續瀏覽下面的相關文章希望大家以後多多支援it145.com!


IT145.com E-mail:sddin#qq.com