movecert
movecert copied to clipboard
Fix install problem and Chrome Certificate Transparency problem
This PR combines the previous install fix from azio7 and also addresses the Certificate Transparency problem with Chrome. The method of addressing the CT problem is described in these issues: movecert issue Adguard issue
The method of this "fix" is to change the primary operation of this module from "moving" to "copying." The certificate is copied to the system store, with the original left in the user store. With the certificate in both places, and if the Zygist DenyList is used against Chrome, the all objectives are achieved. Chrome will use the certificate from the user store, where CT is not enforced by default, and all other apps will use the certificate from the System store, where it's often trusted by default.
Implemented solution is described below. Directly copied from the Adguard issue explanation. https://github.com/AdguardTeam/AdguardForAndroid/issues/4124#issuecomment-1066078974
Recommended way to use this module:
- Install the updated Move Certificates module.
- Install the desired certificate to user store.
- In Magisk, enable Zygisk, enable Enforce DenyList and then add Chrome to the DenyList.
- Reboot your phone.
- Chrome should work using the certificate in the user store, and all the other apps should work using the certificate in the system store.
- If you want to add any other apps later, just add them to the Magisk Hide list/DenyList, then force stop that app. Next time it launches it should use the certificate in the user store. Removal works the same way.
@ianmacd I don't use Magisk anymore. Please review.
This fix works for me. Certificates are now both in the user and system store, which makes Chrome happy when applying the Denylist.