Android证书安装过程介绍
一.证书在源码中的路径
5.1系统证书(命名是 openssl x509 -subject_hash_old -in filename)
libcore/luni/src/main/files/cacerts
7.1及以后系统证书
/system/ca-certificates/files
二.证书在固件中的路径
/system/etc/security/cacerts
三.手动安装流程
设置-->安全-->从sd卡安装证书:
在androidmanif.xml里
<preference android:key="credentials_install" android:title="@string/credentials_install" android:summary="@string/credentials_install_summary" android:persistent="false"> <intent android:action="android.credentials.install" android:targetpackage="com.android.certinstaller" android:targetclass="com.android.certinstaller.certinstallermain"/> </preference>
packages/apps/certinstaller
certinstallermain打开document,选择证书文件,选择好后。启动cerinstaller
然后根据证书类型区分createpkcs12passworddialog和createnamecredentialdialog,看个简单的createnamecredentialdialog
try { startactivityforresult( mcredentials.createsysteminstallintent(), //intent intent = new intent("com.android.credentials.install"); request_system_install_code); } catch (activitynotfoundexception e) { log.w(tag, "systeminstall(): " + e); toasterrorandfinish(r.string.cert_not_saved); }
看intent,又到了settings的credentialstorage
settings/src/com/android/settings/credentialstorage.java installifavailable
添加证书:settings/src/com/android/settings/credentialstorage.java installifavailable()
删除证书:settings/src/com/android/settings/trustedcredentialssettings.java aliasoperation#doinbackground
显示证书:settings/src/com/android/settings/trustedcredentialssettings.java adapterdata#aliasloader#doinbackground
证书内容:settings/src/com/android/settings/trustedcredentialssettings.java certholder sslcertificate
安装类型两种: userkey和ca证书(pk12要处理密码)
certinstaller\src\com\android\certinstaller\credentialhelper.java
异常码:
机器未设置密码锁
机器未解锁
锁屏方式不符合要求还是packages/apps/certinstaller/certinstallermain,startactivityforresult结果回调
if (requestcode == request_system_install_code) { if (resultcode == result_ok) { log.d(tag, "credential is added: " + mcredentials.getname()); toast.maketext(this, getstring(r.string.cert_is_added, mcredentials.getname()), toast.length_long).show(); if (mcredentials.hascacerts()) { // more work to do, don't finish just yet new installcacertstokeychaintask().execute(); return; } setresult(result_ok); } else { log.d(tag, "credential not saved, err: " + resultcode); toasterrorandfinish(r.string.cert_not_saved); } }
如果是cacerts,还要进行 new installcacertstokeychaintask().execute() --> mcredentials.installcacertstokeychain --> keychainservice.installcacertificate
keychainservice实现在packages/apps/keychain mtrustedcertificatestore.installcertificate
external/conscrypt/src/platform/java/org/conscrypt/trustedcertificatestore installcertificate --> writecertificate
四.c层
system/security/keystore/keystore.cpp
添加证书 installifavailable -> mkeystore.put -> mbinder.insert (这里还是java层)
-> keystoreproxy::insert -> keystore::put (这里getencryptionkey用到一个aeskey,哪里来的?)
五.为什么要锁屏密码
以设置密码为例
settings/src/com/android/settings/chooselockpassword.java mlockpatternutils.savelockpassword
frameworks/base/core/java/com/android/internal/widget/lockpatternutils.java getlocksettings().setlockpassword
frameworks/base/services/core/java/com/android/server/locksettingsservice.java setlockpassword -> maybeupdatekeystore -> ks.passworduid
-> 到keystore.cpp的password_uid
password_uid 有三种状态,其中state_uninitialized和state_locked都会调用setupmasterkeys,经锁屏密码设置aeskey
这里就解答了添加证书时的aeskey是哪来的
这个是基于android5.1分析的,高版本可能文件名不同,但是知道大概位置,搜索下,应该没什么难度
到此这篇关于android证书安装过程介绍的文章就介绍到这了,更多相关android证书安装内容请搜索以前的文章或继续浏览下面的相关文章希望大家以后多多支持!
推荐阅读
-
解决Android Studio安装过程中“SDK tools directory is missing”的问题
-
Android Activity启动流程, app启动流程,APK打包流程, APK安装过程
-
mac 下安装php7全过程介绍
-
oracle11g 最终版本11.2.0.4安装详细过程介绍
-
配置JAVA环境+安装Android Studio全过程+踩坑记录
-
Ubuntu下载安装android 源码全过程
-
android 8.1安装mintproxy证书到系统中
-
Android面试题(32)-android编译过程和安装流程
-
Nginx下SSL证书安装部署步骤介绍
-
linux环境下安装mysql8.0过程介绍