From: Soren Stoutner <soren@stoutner.com>
Date: Wed, 11 Nov 2020 03:12:55 +0000 (-0700)
Subject: Trust user certificate authorities on API >= 24.  https://redmine.stoutner.com/issues/636
X-Git-Tag: v3.6~1
X-Git-Url: https://gitweb.stoutner.com/?p=PrivacyBrowserAndroid.git;a=commitdiff_plain;h=dbbcc6598e2192990dbf9579627ad080e73094db;ds=sidebyside

Trust user certificate authorities on API >= 24.  https://redmine.stoutner.com/issues/636
---

diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
index e499e37f..63449cfe 100644
--- a/app/src/main/res/xml/network_security_config.xml
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -18,8 +18,15 @@
   You should have received a copy of the GNU General Public License
   along with Privacy Browser.  If not, see <http://www.gnu.org/licenses/>. -->
 
-<!-- Allow HTTP traffic and disable HSTS, which has no benefit for Privacy Browser (because unspecified links default to HTTPS) but has negative fingerprinting implications. -->
-<network-security-config
-    xmlns:tools="http://schemas.android.com/tools">
-    <base-config cleartextTrafficPermitted="true" hstsEnforced="false" tools:ignore="InsecureBaseConfiguration" />
+<network-security-config xmlns:tools="http://schemas.android.com/tools">
+    <!-- Allow HTTP traffic and disable HSTS, which has no benefit for Privacy Browser (because unspecified links default to HTTPS) but has negative fingerprinting implications. -->
+    <base-config cleartextTrafficPermitted="true" hstsEnforced="false" tools:ignore="InsecureBaseConfiguration">
+        <trust-anchors>
+            <!-- Trust system certificate authorities. -->
+            <certificates src="system" />
+
+            <!-- Trust user certificate authorities. -->
+            <certificates src="user" tools:ignore="AcceptsUserCertificates" />
+        </trust-anchors>
+    </base-config>
 </network-security-config>
\ No newline at end of file