MetaMask / MetaMask/metamask-mobile

Trust User's Root Certificate Store

Open
#3,422 7 comments 1 reaction 0 assignees View on GitHub
team-wallet-api-platform-deprecated
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

### **Description**

At least on android, the metamask browser does not trust ssl (root) certs that were manually installed by the user into their device's trust store. This behavior is different from literally every other mobile browser, and locks the user into relying exclusively on the (centralized) list of root certs provided by the metamask team, if they want to use their wallet. It is also different from the desktop behaviour, where the extension works on sites whose certs were signed by an authority the user chose to trust.

This is also the only reason why our new smart contract oracle platform based on enclaves (which requires trusting a root cert generated inside the first enclave) does not work on mobile right now.

Can we change this?

### **Technical Details**

Change the ssl trust store to use the devices system trust store.

### **Acceptance Criteria**

The user must be able to manually add ssl root certs that the metamask browser will accept.

Contributor guide

Open the contributing guide

Research direction

Start by locating the mobile browser's SSL trust-store configuration and how Android certificate validation is performed. Verify the behavior with a user-installed root certificate, then confirm that the browser accepts it without weakening trust validation on supported mobile platforms.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, react-native, typescript
Domain
mobile-dev, networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.