MetaMask / MetaMask/metamask-mobile
Trust User's Root Certificate Store
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 1.7k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 669
Description
### **Description**
At least on android, the metamask browser does not trust ssl (root) certs that were manually installed by the user into their device's trust store. This behavior is different from literally every other mobile browser, and locks the user into relying exclusively on the (centralized) list of root certs provided by the metamask team, if they want to use their wallet. It is also different from the desktop behaviour, where the extension works on sites whose certs were signed by an authority the user chose to trust.
This is also the only reason why our new smart contract oracle platform based on enclaves (which requires trusting a root cert generated inside the first enclave) does not work on mobile right now.
Can we change this?
### **Technical Details**
Change the ssl trust store to use the devices system trust store.
### **Acceptance Criteria**
The user must be able to manually add ssl root certs that the metamask browser will accept.
Contributor guide
Research direction
Start by locating the mobile browser's SSL trust-store configuration and how Android certificate validation is performed. Verify the behavior with a user-installed root certificate, then confirm that the browser accepts it without weakening trust validation on supported mobile platforms.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, react-native, typescript
- Domain
- mobile-dev, networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100