How to remove App installed trusted CA cert on uninstalling the App

Question

I have an app that gives option to install CA cert and it gets stored in the user tab of Trusted Credentials and it works as expected.

FYI (This is how I install the cert):

Intent installIntent = KeyChain.createInstallIntent();
javax.security.cert.X509Certificate x509 = javax.security.cert.X509Certificate.getInstance(caRootCertBytes);
installIntent.putExtra(KeyChain.EXTRA_CERTIFICATE, x509.getEncoded());
installIntent.putExtra(KeyChain.EXTRA_NAME,caRootCertName);
startActivity(installIntent);

If the app is uninstalled the cert remains in the Trusted credentials.

I would like the cert to be uninstalled when the application is uninstalled.

I thought of removing the cert using deleteEntry method of KeyStore.

FYI (I haven't tested though.Hopefully it should work..I will update once I tested it)

javax.security.cert.X509Certificate x509 = javax.security.cert.X509Certificate.getInstance(caRootCertBytes);

KeyStore ks = KeyStore.getInstance("AndroidCAStore")
if (ks != null) 
                        {
                            ks.load(null, null);
                            Enumeration<String> aliases = ks.aliases();
                            while (aliases.hasMoreElements()) 
                            {
                                String alias = (String) aliases.nextElement();
                                java.security.cert.X509Certificate cert = (java.security.cert.X509Certificate) ks.getCertificate(alias);
                                String name = x509.getIssuerDN().getName();                             
                                if (cert.getIssuerDN().getName().contains(name)) 
                                {
                                  ks. deleteEntry(alias)

                                }
                            }
                        }  

Even though if you consider above code works AFAIK I can't register broadcast receiver for uninstallation of my own app.

How can I go about removing the cert that is installed by my app on uninstallation of my app ?

Any help is appreciated !

Answer 1

you cant get the broadcast of package getting uninstalled for your own package. this may lead to inconsistency in the system. see this answer