movecert icon indicating copy to clipboard operation
movecert copied to clipboard

Fix install problem and Chrome Certificate Transparency problem

Open andyacer opened this issue 2 years ago • 3 comments

This PR combines the previous install fix from azio7 and also addresses the Certificate Transparency problem with Chrome. The method of addressing the CT problem is described in these issues: movecert issue Adguard issue

The method of this "fix" is to change the primary operation of this module from "moving" to "copying." The certificate is copied to the system store, with the original left in the user store. With the certificate in both places, and if the Zygist DenyList is used against Chrome, the all objectives are achieved. Chrome will use the certificate from the user store, where CT is not enforced by default, and all other apps will use the certificate from the System store, where it's often trusted by default.

andyacer avatar Jul 17 '22 21:07 andyacer

Implemented solution is described below. Directly copied from the Adguard issue explanation. https://github.com/AdguardTeam/AdguardForAndroid/issues/4124#issuecomment-1066078974

Recommended way to use this module:

  1. Install the updated Move Certificates module.
  2. Install the desired certificate to user store.
  3. In Magisk, enable Zygisk, enable Enforce DenyList and then add Chrome to the DenyList.
  4. Reboot your phone.
  5. Chrome should work using the certificate in the user store, and all the other apps should work using the certificate in the system store.
  6. If you want to add any other apps later, just add them to the Magisk Hide list/DenyList, then force stop that app. Next time it launches it should use the certificate in the user store. Removal works the same way.

andyacer avatar Jul 17 '22 21:07 andyacer

@ianmacd I don't use Magisk anymore. Please review.

yochananmarqos avatar Jul 17 '22 22:07 yochananmarqos

This fix works for me. Certificates are now both in the user and system store, which makes Chrome happy when applying the Denylist.

FrankSpierings avatar Jul 25 '22 10:07 FrankSpierings