Android MDM安装PFX客户端证书后无法获取私钥问题排查

我开发了一款面向Android设备的MDM应用，需要从Download文件夹读取PKCS12标准的.pfx客户端证书（由CA签发，安装需用户输入密码）并完成安装。目前证书安装成功，但后续无法获取私钥，其他应用也无法访问该证书：

• 通过KeyChain获取私钥时，日志提示「Private key not found」；
• 通过AndroidKeyStore获取时，所有相关调用返回null，且抛出错误码7的KeyStore异常。

此前尝试通过Intent安装证书时程序崩溃，因此需要MDM自行完成证书的安装与选择操作。以下是相关代码实现及日志信息：

安装证书函数 #

override fun installCertificate(certificate: File, password: String) {
        Log.i(TAG, "[installCertificate] Start install certificate certificate: $certificate | password: $password")

        val keyStore = KeyStore.getInstance(KEY_STORE_TYPE)
        FileInputStream(certificate).use { fis -> keyStore.load(fis, password.toCharArray()) }

        val alias = keyStore.aliases().nextElement()
        val key = keyStore.getKey(alias, password.toCharArray()) as PrivateKey
        val certChain = keyStore.getCertificateChain(alias)
        val dpm = activity.getSystemService(Context.DEVICE_POLICY_SERVICE) as DevicePolicyManager
        val adminComponentName = LegacyUtils.getAdminComponentName(activity)

        val certData = secretEncryptor.getCertificate(keyStore) as? X509Certificate ?: throw Exception()
        val certificateAlias = certData.subjectX500Principal.name
        val isOverwrite = dpm.installKeyPair(adminComponentName, key, certChain, alias, 0)
        lastAlias = alias

        Log.i(TAG,
            "[installCertificate] Certificate $certificate installed | alias: $lastAlias | isOverwrite: $isOverwrite")
    }

通过KeyChain获取证书函数 #

private fun getCertificate(alias: String) {
        KeyChain.getPrivateKey(activity, alias)?.let { privateKey ->
            KeyChain.getCertificateChain(activity, alias)?.let { certChain ->
                val certificate = certChain.firstOrNull()
                if (certificate != null) {
                    Log.i(TAG, "[getCertificate] Сертификат найден | alias: $alias")
                    // TODO: work with certificate
                } else {
                    Log.e(TAG, "[getCertificate] Certificate not found | alias: $alias")
                }
            } ?: run {
                Log.e(TAG, "[getCertificate] No certificate chain found | alias: $alias")
            }
        } ?: run {
            Log.e(TAG, "[getCertificate] Private key not found | alias: $alias")
        }
    }

调用代码 #

CoroutineScope(Dispatchers.IO).launch {
            getCertificate(lastAlias)
        }

相关日志 #

[checkCertificatesAndInstallIfExist] certificates: [/storage/emulated/0/Download/cert.pfx]
2024-08-06 11:08:25.473 15588-15588 CertificatesManagerImp  com.hmdm.launcher                    I  [installCertificate] Start install certificate certificate: /storage/emulated/0/Download/cert.pfx | password: 1234
2024-08-06 11:08:26.375 15588-15588 CertificatesManagerImp  com.hmdm.launcher                    I  [installCertificate] Certificate /storage/emulated/0/Download/cert.pfx installed | alias: tq-70b931d7-cb80-4e2e-a617-c4d59435b8f4 | isOverwrite: true
2024-08-06 11:08:27.498 15588-15659 CertificatesManagerImp  com.hmdm.launcher                    E  [getCertificate] Private key not found | alias: tq-70b931d7-cb80-4e2e-a617-c4d59435b8f4

通过AndroidKeyStore获取证书的尝试及日志 #

尝试通过AndroidKeyStore获取证书时，所有调用均返回null并抛出异常：

private fun getCertificate(alias: String) {
        val keyStore = KeyStore.getInstance("AndroidKeyStore")
        keyStore.load(null)

        val key1 = keyStore.getKey(alias, null)
        val key2 = keyStore.getKey(alias, "1234".toCharArray())
        val certificate1 = keyStore.getCertificateChain(alias)
        val certificate2 = keyStore.getCertificate(alias)
        val certificate3 = keyStore.getEntry(alias, null) as? KeyStore.PrivateKeyEntry
        Log.i(TAG, "[getCertificate] Certificate $certificate3 | alias: $alias ")
    }

日志信息：

2024-08-06 18:01:03.781  6289-6878  KeyStore                com.hmdm.launcher                   W  KeyStore exception
    android.os.ServiceSpecificException:  (code 7)
                                                                                                    
    at android.os.Parcel.createException(Parcel.java:2085)
    at android.os.Parcel.readException(Parcel.java:2039)
    at android.os.Parcel.readException(Parcel.java:1987)
    at android.security.keystore.IKeystoreService$Stub$Proxy.get(IKeystoreService.java:978)
    at android.security.KeyStore.get(KeyStore.java:236)
    at android.security.KeyStore.get(KeyStore.java:225)
    at android.security.keystore.AndroidKeyStoreSpi.engineGetCertificate(AndroidKeyStoreSpi.java:165)
    at java.security.KeyStore.getCertificate(KeyStore.java:1120)
    at com.hmdm.launcher.certificates.CertificatesManagerImp.getCertificate(CertificatesManagerImp.kt:109)
    at com.hmdm.launcher.certificates.CertificatesManagerImp.access$getCertificate(CertificatesManagerImp.kt:29)
    at com.hmdm.launcher.certificates.CertificatesManagerImp$getAllCertificates$1.invokeSuspend(CertificatesManagerImp.kt:98)
    at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
    at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:106)
    at kotlinx.coroutines.internal.LimitedDispatcher.run(LimitedDispatcher.kt:42)
    at kotlinx.coroutines.scheduling.TaskImpl.run(Tasks.kt:95)
    at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:570)
    at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:749)
    at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker(CoroutineScheduler.kt:677)
    at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:664)

问题分析与解决方案 #

核心问题

1. 存储位置混淆：MDM通过DevicePolicyManager.installKeyPair安装的密钥对，默认存储在系统KeyChain而非AndroidKeyStore中，直接访问AndroidKeyStore必然找不到条目（错误码7对应KEY_ERROR_NOT_FOUND）。
2. KeyChain调用方式错误：KeyChain.getPrivateKey是异步API，不能在IO协程中同步调用，必须通过回调触发授权流程（部分Android版本即使是MDM应用也需显式授权）。

修复步骤

1. 改用KeyChain异步回调获取私钥

替换原同步调用的getCertificate函数，使用官方推荐的异步回调方式：

private fun getCertificate(targetAlias: String) {
    val callback = object : KeyChainAliasCallback {
        override fun alias(selectedAlias: String?) {
            selectedAlias ?: run {
                Log.e(TAG, "[getCertificate] 用户取消操作或别名不存在")
                return
            }
            // 在IO线程异步获取证书信息
            CoroutineScope(Dispatchers.IO).launch {
                runCatching {
                    val privateKey = KeyChain.getPrivateKey(activity, selectedAlias)
                    val certChain = KeyChain.getCertificateChain(activity, selectedAlias)
                    if (privateKey != null && certChain != null) {
                        val certificate = certChain.firstOrNull()
                        Log.i(TAG, "[getCertificate] 证书已找到 | alias: $selectedAlias")
                        // 此处处理证书业务逻辑
                    } else {
                        Log.e(TAG, "[getCertificate] 私钥或证书链缺失 | alias: $selectedAlias")
                    }
                }.onFailure {
                    Log.e(TAG, "[getCertificate] 获取证书失败", it)
                }
            }
        }
    }
    // 指定目标别名直接触发授权，无需用户手动选择
    KeyChain.choosePrivateKeyAlias(activity, callback, arrayOf(targetAlias), null, null, -1, targetAlias)
}

2. 确认MDM权限配置

• 确保应用已激活设备管理员权限，Manifest中添加必要权限：

<uses-permission android:name="android.permission.MANAGE_DEVICE_ADMINS" />
<uses-permission android:name="android.permission.USE_CREDENTIALS" />

3. 适配Android版本差异

• Android 10及以上：MDM应用可通过setKeyPairAlias绑定证书与应用，跳过用户授权弹窗：

dpm.setKeyPairAlias(adminComponentName, targetAlias, activity.packageName)

• Android 9及以下：必须通过KeyChain.choosePrivateKeyAlias触发用户授权，无法跳过。

4. 验证证书安装状态

通过系统设置「安全 > 加密与凭据 > 用户凭据」查看是否存在对应别名的证书，确认安装是否真正生效。

额外说明

• 系统KeyChain是全局凭据存储，AndroidKeyStore是应用隔离的密钥容器，两者不可混淆；
• 其他应用访问该证书时，需拥有USE_CREDENTIALS权限且获得用户授权。

内容的提问来源于stack exchange，提问作者Ekatarina El