Android apps store client certificates in a secure and correct way

atomic

I'm building an Android application that requires certificate based authentication. I'm not very familiar with the Java/Kotlin programming paradigm.

The certificate will be issued in one of two ways: via the API (controlled by me) or via a device management tool such as MobiControl (this is the only one currently, but we may have to use other device management tools).

I need a way to store the certificate securely, but we can deploy the certificate automatically using device management suite and the certificate can be kept indefinitely. Is the certificate store sufficient? https://developer.android.com/reference/java/security/cert/CertStore

In UNIX I would store them there, /etc/ssl/certsbut I don't know if this is a valid Android way.

robert

If an app wishes to store client certificates that are only used by that app, it is strongly recommended that you use AndroidKeyStoresystem . See also this blog entry .

If the device supports it, the private key is stored encrypted and cannot be accessed by the application (only used). The event is that the application itself cannot extract the private key, but it can sign or decrypt data using the private key for example using a java Cipherinstance .

Also, you can just set a flag that using a certificate requires device authentication (eg by fingerprint) before the device can be used.

Related

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

How can I store the client's API key in a secure way?

username I'm developing a SAAS service that allows my clients to connect 3rd party email tools (eg MailChimp). So I am asking for an API key associated with the desired service to allow some actions to be performed automatically on their account. For this, I l

How can I store the client's API key in a secure way?

username I'm developing a SAAS service that allows my clients to connect 3rd party email tools (eg MailChimp). So I am asking for an API key associated with the desired service to allow some actions to be performed automatically on their account. For this, I l

How can I store the client's API key in a secure way?

username I'm developing a SAAS service that allows my clients to connect 3rd party email tools (eg MailChimp). So I am asking for an API key associated with the desired service to allow some actions to be performed automatically on their account. For this, I l

Android and client certificates

Anthony B Code I've been searching for weeks and can't seem to find an answer anywhere. I am trying to do the following for Android. The code is from a C# app I wrote but am porting it to Android. Web endpoints require certificates to be attached to mutual aut

Android and client certificates

Anthony B Code I've been searching for weeks and can't seem to find an answer anywhere. I am trying to do the following for Android. The code is from a C# app I wrote but am porting it to Android. Web endpoints require certificates to be attached to mutual aut

Correct way to store temporary files to be shared in Android

Bruno I'm currently using the app in my app , the file can be downloaded for use or shared with other apps (email as attachment, whatsapp, etc).getExternalCacheDir() It works fine, but I'm not sure if this is the correct way. Vyacheslav You can save local file

Is this the correct/secure way to log someone in?

ach1lles Ok, I'm really new to programming (just learned today how to make a database connection and how to read/read data from a database) and I'm trying to create a basic site that allows you to log in users and have some kind of After the page user is logge

Is this the correct/secure way to log someone in?

ach1lles Ok, I'm really new to programming (just learned today how to make a database connection and how to read/read data from a database) and I'm trying to create a basic site that allows you to log in users and have some kind of After the page user is logge

Is this the correct/secure way to log someone in?

ach1lles Ok, I'm really new to programming (just learned today how to make a database connection and how to read/read data from a database) and I'm trying to create a basic site that allows you to log in users and have some kind of After the page user is logge

A secure way to store secret credentials

Atul Kumar I have an Android app that I want to deploy for commercial use. I'm using AWS secret credentials, which are currently hardcoded in the code. Is there any secure way to deploy android app by passing credentials as external parameters. Pass the creden

A secure way to store secret credentials

Atul Kumar I have an Android app that I want to deploy for commercial use. I'm using AWS secret credentials, which are currently hardcoded in the code. Is there any secure way to deploy android app by passing credentials as external parameters. Pass the creden

A secure way to store secret credentials

Atul Kumar I have an Android app that I want to deploy for commercial use. I'm using AWS secret credentials, which are currently hardcoded in the code. Is there any secure way to deploy android app by passing credentials as external parameters. Pass the creden

Developing Secure VoIP Android Apps

Dragoș Grumeza I want to develop an android application. This is my first and it has to be a secure VoIP application. I've been told to use webRTC and after a lot of research I'm stuck. I don't understand how webRTC works. Can you assist me with some steps to

Developing Secure VoIP Android Apps

Dragoș Grumeza I want to develop an android application. This is my first and it has to be a secure VoIP application. I've been told to use webRTC and after a lot of research I'm stuck. I don't understand how webRTC works. Can you assist me with some steps to

Is this the correct way to store subcollections?

Zhan I have a collection of users and from there I would like to have a sub-collection of vaccination information about a particular user. This is how I keep the subcollections in the users collection. const handleSubmit = (e) => { e.preventDefault();

Is it the correct way to sign my Android app for the Play Store?

Ruan I'm a beginner personal game developer and I'm still learning how everything works. I watched a series of tutorials on making games in Unity that showed how to sign your app for Google Play. They imply that you make a new "Key"/"Alias" for every new game

Is it the correct way to sign my Android app for the Play Store?

Ruan I'm a beginner personal game developer and I'm still learning how everything works. I watched a series of tutorials on making games in Unity that showed how to sign your app for Google Play. They imply that you make a new "Key"/"Alias" for every new game

Is it the correct way to sign my Android app for the Play Store?

Ruan I'm a beginner personal game developer and I'm still learning how everything works. I watched a series of tutorials on making games in Unity that showed how to sign your app for Google Play. They imply that you make a new "Key"/"Alias" for every new game