Update trusted SSL root certs in AOSP

Question

I have some legacy Android 6 devices in an industrial setting which must access a website via https. However, the list of trusted root certificates is out of date. Trying to connect to such a site results in errors like:

07-30 09:27:00.979  4273  4481 E chromium: [ERROR:ssl_client_socket_impl.cc(960)] handshake failed; returned -1, SSL error code 1, net_error -201
07-30 09:27:00.990  4273  4273 I myapp: Err onReceivedSslError / primary error: 4 certificate: Issued to: CN=example.com;
07-30 09:27:00.990  4273  4273 I myapp: Issued by: CN=R3,O=Let's Encrypt,C=US;
07-30 09:27:00.990  4273  4273 I myapp:  on URL: https://example.com/
07-30 09:27:01.390  5985  6721 I NativeSslSession: Error inflating SSL session: {0}

How do I update the root certificate list as used by chromium / webview? I have the AOSP sources for the system.

Answer 1

The root CA are located in the path: system/ca-certificates/files/

Try getting new ones from the master branch of AOSP: https://android.googlesource.com/platform/system/ca-certificates/+/refs/heads/master/files/