Why am I allowed to add a self-signed CA certificate to an Android application?

Viewed 38

Just a question to clarify something:

I created a self-signed certificate in order to use HTTPS for a small IoT application. I'm going to control the corresponding device with an Android app.

Because I'm using a self-signed certificate my app did not trust the device when trying to establish a HTTPS connection at first. Thats why I had to install the CA certificate myself in the Android settings. Everything worked fine afterwards.

However I just found out that you can actually include that CA certificate with your Android app, if you create a special network_security_config.xml file with the following content:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config>
        <trust-anchors>
            <certificates src="@raw/selfsigned_ca" />
        </trust-anchors>
    </base-config>
</network-security-config>

After also editing the AndroidManifest.xml file I no longer need to manually install the CA certificate on any device in order to use HTTPS in my Android app.

How is this safe? Am I missing something? Pretty much everyone tells you that using self-signed certificates isn't the best idea in most cases. No device will trust your service cause it doesn't know the CA. However I can create an Android app that just trusts my CA no matter what without the user knowing about it.

Why is this a feature?

0 Answers
Related