How do I generate a PKCS12 CA certificate for use with Packet Capture?

Question

I was trying to use Packet Capture app to find out some URLs used by an app. Packet Capture allows you to capture SSL packets by installing a VPN Gateway with its own root CA certificate and then channeling app requests through that gateway. However, when I try to generate the certificate from within the app (on my Galaxy Note 8), I just get the error "Cannot create certificate". I don't know why this is as the app doesn't give any further explanation, but this means I can't use SSL capture in the app.

The app does have another way to just import an existing CA certificate, known as "Import PKCS#12 file". However I need to generate the PKCS#12 file myself to use this, and not sure how to do this.

What I did so far: I installed the app "Dory". Then I tried creating a public/private keypair, CSR and root CA certificate, all the time setting the passphrase and alias to "abc". But when I tried to import the p12 file to Packet Capture, it just said "java.lang.RuntimeException: Cannot load key. Password might be wrong." I must have done something wrong; what should I be doing next?

— Kidburla | Sources

Answer

I had some issues with this after the Android 11 update. Android 11 no longer allows you to add certificates from any app other than the settings app, so you will have to generate and set the certificate yourself.

Generate the certificate in linux. You can also do this on the device if you get an openssl app or terminal. I followed this tutorial, except I added the name "alias" to the p12 key:

openssl req -x509 -newkey rsa:4096 -keyout myKey.pem -out cert.pem -days 365 -nodes

Hit enter for all the prompts

openssl pkcs12 -export -out keyStore.p12 -inkey myKey.pem -in cert.pem -name "alias"

Enter the password "test"

Transfer keyStore.p12 and cert.pem to the android device

In android settings, go to Biometrics and Security (note I have a Samsung device, it might be different for you) > Other Security Settings > Credential Storage > Install from device storage > CA Certificate > Accept the scary red warning and tap "Install anyway" > enter your pincode > find "cert.pem" and click "Done"

Going back to "Install from device storage," > VPN and app user certificate > find keyStore.p12 > Enter password "test" and name it "alias"

Go the the app info screen for Packet Capture > Permissions > Files And Media > Enable "Allow management of all files"

Open packet capture > Setting > Tap "No CA certificate" > Import PKCS#12 file. Restart packet capture. If everything worked, the "Status" subtitle should say "Installed to trusted credentials"

Restart device

SSL should work for most apps now but it can be hit and miss

— Jared Kozak | Sources

How do I generate a PKCS12 CA certificate for use with Packet Capture?

Topics