[Android] User root CAs ignored when downloading remote profile configuration

Operating system

Android

System version

Android 15

Installation type

sing-box for Android Graphical Client

If you are using a graphical client, please provide the version of the client.

1.13.13

Version

Description

Exactly same problem as in #2433 but when creating a new profile.

Reproduction

1. Create a root CA and a server certificate signed by it using OpenSSL
2. Get root CA file on an Android device and server certificates on a server.
3. Prepare a server:
   • Install nginx (eg. sudo apt install nginx)
   • Peplace it's configuration file (eg. /etc/nginx/nginx.conf) with a one provided below
   • Restart server: nginx -s reload
4. Install root CA on Android device:
   • Settings → Security and privacy → Advanced settings → Credential storage → Install certificates from file → Root CA
   • Dismiss warning message and enter password/fingerprint/etc.
   • Browse and install root CA file
5. In Android client: Profiles "+" → Create Manually → Name=anything → Type=Remote → URL=https://USER:PASS@IPADDR:PORT/config.json → Create

nignx.conf

events {
  worker_connections 1024;
}
http {
  server {
    listen 443 ssl;
    ssl_certificate PATH_TO/PUBLIC.crt;
    ssl_certificate_key PATH_TO/PRIVATE.key;
    ssl_protocols TLSv1.2 TLSv1.3;
  }
}

Logs

Absolutely nothing, I don't get to start the proxy

Error message:

Get "https://USER:PASS@IPADDR:PORT/config.json": tls: failed to verify certificate: x509: certificate signed by unknown authority

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by comparing this reproduction with issue #2433, then follow the Android client's remote profile creation and download path for the URL in the report. Use the provided nginx.conf and installed root CA to reproduce the certificate error; done means a newly created remote profile accepts a server certificate signed by the user's Android-installed CA.