Overview
Developed by NVISO Security, AlwaysTrustUserCerts is the de-facto standard mobile penetration testing tool for intercepting SSL/TLS encrypted traffic on rooted Android devices.
When security researchers or developers need to inspect mobile API traffic using proxy tools like Burp Suite, OWASP ZAP, or mitmproxy, they install custom root CA certificates on the device. However, modern Android versions strictly isolate user CAs from application network stacks. AlwaysTrustUserCerts automatically monitors user certificate installations and elevates them into the authoritative system trust store at boot.
Technical Architecture & How It Works
The Systemless Certificate Overlay
- User Certificate Detection: When a user installs a certificate via Android Settings $\rightarrow$ Security $\rightarrow$ Encryption & Credentials, Android places the
.0hashed certificate file into/data/misc/user/0/cacerts-added/. - Early Boot Synchronization: During the
post-fs-datastage, AlwaysTrustUserCerts scans/data/misc/user/0/cacerts-added/for new certificates. - Magic Mount Integration: The module copies the detected certificates into
/data/adb/modules/alwaystrustusercerts/system/etc/security/cacerts/and fixes permissions (chmod 644,chown root:root). - Trust Store Overlay: Magisk / KernelSU mounts this directory over
/system/etc/security/cacerts/. When any application initiates a TLS handshake, Android’s Bionic cryptographic libraries treat the proxy certificate as a pre-installed, trusted root authority.
Installation & Usage (Penetration Testing Workflow)
Step 1: Install the Module
- Download
AlwaysTrustUserCerts.zipand flash it in Magisk or KernelSU. - Reboot your device.
Step 2: Install Your Proxy CA Certificate
- Export the CA certificate from your proxy tool (e.g.,
cacert.derfrom Burp Suite). - Rename the extension to
.crtand transfer it to your device’s internal storage. - On your Android device, go to Settings $\rightarrow$ Security $\rightarrow$ Install a certificate $\rightarrow$ CA certificate $\rightarrow$ select the file.
- Name the certificate (e.g., “BurpCA”) and confirm.
Step 3: Reboot to Promote
Reboot your phone. The certificate will now appear under Trusted Credentials $\rightarrow$ System, and your proxy will successfully decrypt HTTPS API requests.
