Just a question to clarify something:
I created a self-signed certificate in order to use HTTPS for a small IoT application. I'm going to control the corresponding device with an Android app.
Because I'm using a self-signed certificate my app did not trust the device when trying to establish a HTTPS connection at first. Thats why I had to install the CA certificate myself in the Android settings. Everything worked fine afterwards.
However I just found out that you can actually include that CA certificate with your Android app, if you create a special network_security_config.xml file with the following content:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config>
<trust-anchors>
<certificates src="@raw/selfsigned_ca" />
</trust-anchors>
</base-config>
</network-security-config>
After also editing the AndroidManifest.xml file I no longer need to manually install the CA certificate on any device in order to use HTTPS in my Android app.
How is this safe? Am I missing something? Pretty much everyone tells you that using self-signed certificates isn't the best idea in most cases. No device will trust your service cause it doesn't know the CA. However I can create an Android app that just trusts my CA no matter what without the user knowing about it.
Why is this a feature?