In this tutorial, you will learn how to install an SSL certificate on Android, the most widely used mobile operating system in the world. If you have not applied for a certificate yet, the first part of this guide shows you how to generate a CSR code for your Android app.
Generate a CSR code for Android apps
CSR stands for Certificate Signing Request, a block of encoded text that contains your contact data. Every SSL applicant generates a CSR and sends it to the Certificate Authority (CA) during enrollment. You have two options:
- Generate the CSR automatically with our CSR Generator.
- Follow our step-by-step tutorial on how to create the CSR on Android.
Submit the CSR to the Certificate Authority when you place your order. After the CA validates it and issues your certificate, continue with the installation below.
Install an SSL certificate on Android
After your CA validates the request and emails you the certificate files, you can install them on your device. First, confirm that your files match what Android expects.
Before you begin: check the file format
Android reads X.509 certificates in two situations, and the file format decides which install option you use:
- A public certificate file in .crt, .cer, .pem, or .der format. This holds only the certificate, with no private key. Install it as a CA certificate.
- A PKCS#12 key store in .p12 or .pfx format. This bundles the certificate together with its private key in one password-protected file. Install it as a VPN & app user certificate (called Install from device storage on Samsung).
If your files are in a different format, convert them first with our SSL tools. To build a .p12 file, you need the certificate, the CA bundle, and the private key, and you will set a password (passphrase) during the conversion. Keep that password handy: Android asks for it during installation.
Step 1: Copy the certificate file to your device
Move the certificate file to your phone’s internal storage or SD card, for example into the Download folder. You can transfer it over USB, save it from an email attachment, or download it through Chrome. Android needs the file to be on the device before it appears in the installer.
Step 2: Open the certificate installer in Settings
The path depends on your Android version and phone maker. Use whichever matches your device:
- Stock Android (Android 12, 13, 14, and 15, including Pixel): open Settings, then Security & privacy, then More security settings, then Encryption & credentials, then Install a certificate.
- Samsung Galaxy (One UI): open Settings, then Biometrics and security, then Other security settings, then Install from device storage.
- Older Android (9 and earlier): open Settings, then Security, then look under Credential storage for Install from storage or Install from SD card.
If you cannot find these items, open the Settings search box and type certificate. The installer entry will appear regardless of where your OEM placed it.
Step 3: Choose the certificate type
When prompted, select the type that matches your file:
- CA certificate for a public certificate file (.crt, .cer, .pem, or .der).
- VPN & app user certificate for a PKCS#12 key store (.p12 or .pfx).
- Wi-Fi certificate if you are setting up certificate-based Wi-Fi authentication.
If you pick CA certificate, Android shows a warning that a certificate authority you install can monitor network traffic. This is expected for a CA you trust on purpose. Tap Install anyway and confirm with your PIN, pattern, password, or fingerprint. If your device has no screen lock set, Android asks you to create one first.
Step 4: Select the file and name the certificate
The file picker opens. Browse to the folder where you saved the certificate (for example Download) and tap the file. If it is a password-protected .p12 or .pfx file, enter the PKCS#12 password you set during conversion. In the certificate name field, type a label you will recognize later, then tap OK to finish.
That is it: your certificate is now installed on your Android device.
Important: app trust on Android 7 and later
Installing a CA certificate adds it to the user certificate store, not the system store. Since Android 7 (Nougat), apps do not trust user-installed CA certificates by default, and Google Chrome ignores them as well. An app trusts a user CA only if its developer opts in through a network security configuration. If you control the app, add a network security config that includes <certificates src=”user” /> so the app accepts your certificate. Browsers and most third-party apps will keep using the built-in system CAs.
Test your SSL installation
After installing the certificate, check that everything works. To confirm the certificate is on the device, open Settings, go to Encryption & credentials (or Other security settings on Samsung), then open Trusted credentials and the User tab to see your certificate listed. To verify the certificate served by a website, scan the domain with our SSL Checker, which returns an instant report on the certificate chain, expiry, and configuration so you can spot any problems.
Frequently Asked Questions
SSL connection errors on Android usually come from a wrong device clock or cached data. Try these fixes in order:
Set the date and time to automatic, since a wrong clock makes valid certificates look expired.
Clear your browser’s cache and cookies.
Temporarily disable any antivirus or VPN app that inspects HTTPS traffic.
Update Android and your browser to the latest version.
For more help, see our guide on how to fix SSL errors.
Open Settings, then Security & privacy, then More security settings, then Encryption & credentials, then Trusted credentials (on Samsung: Biometrics and security, then Other security settings, then View security certificates). The System tab lists the certificates built into Android, and the User tab lists the ones you installed yourself. Tap any entry to view its details.
Any app that sends or receives data over the internet should use HTTPS, which depends on an SSL/TLS certificate on the server it talks to. This protects users against man-in-the-middle attacks and keeps sensitive data private. If your app handles logins or payments, a certificate is required, not optional.
Since Android 7, apps ignore user-installed CA certificates unless the developer opts in. The certificate is installed correctly, but the app trusts only the system certificate store. The fix is on the app side: add a network security configuration that includes the user certificate source, or have the certificate added to the system store on a managed or rooted device.
Save 10% on SSL Certificates when ordering from SSL Dragon today!
Fast issuance, strong encryption, 99.99% browser trust, dedicated support, and 25-day money-back guarantee. Coupon code: SAVE10
