duckduckgo / duckduckgo/Android

[Bug] Adding a trusted local CA to Android is not honored by DDG

Open
#5,497 5 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs triage
Dominant language
Kotlin
Stars
4.8k
Forks
1.4k
Avg merge
2d 17h
Merged PRs (30d)
170

Description

Describe the bug

DDG warns that a site may be insecure even after installing a CA certificate to Android's system level trust store.

How to Reproduce
  • Create a certificate with mkcert
  • Install as a trusted CA in Android Settings
  • Create a cert with common name = foo
  • Make sure DNS or /etc/hosts (eg. Using Virtual Hosts from Fdroid) resolves foo to the host
  • Create an HTTPS server with a mkcert certificate issued from that CA with CN = foo
  • Navigate to that server https://foo
Expected behavior

Chrome, Brave, and Firefox on the same phone all stop warning after the mkcert CA is installed in the system level trust store. I expect DDG to follow suit. This seems like a bug because the warning message claims that the certificate is not trusted by the OS when it is trusted based on being able to navigate to it in other browsers.

Image

Environment
- DDG App Version: 5.222.0 (52220000)
- Device: Pixel 8
- OS: Android 14, Build AP2A.240905.003.B1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the mkcert setup on Android 14 with the listed DDG app version, then trace how the app evaluates HTTPS certificate trust. Confirm the behavior against Chrome, Brave, and Firefox. Done means a site using a CA installed in Android's system trust store no longer produces DDG's insecure warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.