Overview
Developed by ys1231, MoveCertificate was engineered specifically to solve the architectural breaking changes introduced in Android 14 regarding system certificate trust.
In Android 14, Google completed the migration of core operating system security components into Mainline APEX modules. The root CA certificate directory was permanently relocated from /system/etc/security/cacerts/ into the read-only, mounted filesystem of the com.android.conscrypt APEX. Because of this, traditional Magisk modules that mounted certificates into /system ceased functioning completely on Android 14. MoveCertificate implements advanced mount namespace injection to restore full SSL/TLS traffic interception.
Technical Architecture & How It Works
APEX Mount Namespace Injection
- Certificate Scanning: During early boot, MoveCertificate scans user-installed certificates stored in
/data/misc/user/0/cacerts-added/. - Temporary Overlay Creation: It constructs a temporary directory containing both stock Conscrypt CA certificates and your newly added user certificates.
- APEX Namespace Overlay: Because APEX mounts exist in their own private Linux mount namespaces, the module runs a native script inside the root namespace:
mount --bind /data/local/tmp/cacerts_merged /apex/com.android.conscrypt/cacerts - Bionic Trust Propagation: When Android apps initialize TLS sessions, the Bionic Conscrypt crypto engine reads the merged certificates directly from the APEX mount, trusting proxy CA certificates globally.
Installation & Usage
- Open your root manager (Magisk, KernelSU, or APatch).
- Download and flash
MoveCertificate-vX.zip. - Reboot your device.
- Install your proxy CA certificate (e.g. Burp Suite, mitmproxy, Charles) via Android’s standard Settings $\rightarrow$ Security $\rightarrow$ Install from storage $\rightarrow$ CA Certificate.
- Reboot your device one more time.
- Verify under Settings $\rightarrow$ Trusted Credentials $\rightarrow$ System: your proxy certificate is now listed as a valid system authority.
