Android中CredentialManager适配自定义根证书的配置方法咨询

可以通过自定义网络客户端并注入到CredentialManager的依赖中，实现使用自定义根证书完成Passkey认证，具体步骤如下：

1. 加载自定义根证书 #

将自定义根证书（如.cer/.pem格式）放入应用的res/raw目录，然后编写工具方法加载证书并生成SSL相关组件：

import android.content.Context
import java.io.InputStream
import java.security.KeyStore
import java.security.cert.CertificateFactory
import javax.net.ssl.SSLContext
import javax.net.ssl.SSLSocketFactory
import javax.net.ssl.TrustManagerFactory
import javax.net.ssl.X509TrustManager

// 生成自定义SSLSocketFactory
fun getCustomSSLSocketFactory(context: Context): SSLSocketFactory {
    val certFactory = CertificateFactory.getInstance("X.509")
    val certInputStream = context.resources.openRawResource(R.raw.custom_root_cert)
    val certificate = certFactory.generateCertificate(certInputStream)
    certInputStream.close()

    val keyStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply {
        load(null, null)
        setCertificateEntry("custom_root_cert", certificate)
    }

    val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).apply {
        init(keyStore)
    }

    val sslContext = SSLContext.getInstance("TLS").apply {
        init(null, trustManagerFactory.trustManagers, java.security.SecureRandom())
    }

    return sslContext.socketFactory
}

// 获取自定义X509TrustManager
fun getCustomTrustManager(context: Context): X509TrustManager {
    val certFactory = CertificateFactory.getInstance("X.509")
    val certInputStream = context.resources.openRawResource(R.raw.custom_root_cert)
    val certificate = certFactory.generateCertificate(certInputStream)
    certInputStream.close()

    val keyStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply {
        load(null, null)
        setCertificateEntry("custom_root_cert", certificate)
    }

    val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).apply {
        init(keyStore)
    }
    return trustManagerFactory.trustManagers.first() as X509TrustManager
}

2. 创建自定义OkHttpClient #

基于上面的SSL组件，构建带有自定义证书信任逻辑的OkHttpClient：

import okhttp3.OkHttpClient

fun getCustomOkHttpClient(context: Context): OkHttpClient {
    val sslSocketFactory = getCustomSSLSocketFactory(context)
    val trustManager = getCustomTrustManager(context)

    return OkHttpClient.Builder()
        .sslSocketFactory(sslSocketFactory, trustManager)
        .build()
}

3. 配置CredentialManager使用自定义客户端 #

初始化CredentialManager时，将自定义OkHttpClient注入到PasskeyCredentialProvider中：

import android.content.Context
import androidx.credentials.CredentialManager
import androidx.credentials.provider.PasskeyCredentialProvider

fun initCustomCredentialManager(context: Context): CredentialManager {
    val customOkHttp = getCustomOkHttpClient(context)
    val passkeyProvider = PasskeyCredentialProvider.Builder(context)
        .setOkHttpClient(customOkHttp)
        .build()

    return CredentialManager.create(context)
        .setCredentialProvider(passkeyProvider)
        .build()
}

关键注意事项 #

• 该方案仅支持Android 14（API 34）及以上版本，因为PasskeyCredentialProvider.Builder.setOkHttpClient()是API 34新增的方法。Passkey本身在低版本系统上支持有限，若需兼容请评估系统适配方案。
• 确保自定义根证书的合法性与安全性，避免信任未知证书引发中间人攻击风险。
• 证书文件需正确放置在res/raw目录，注意文件名不要包含特殊字符。

内容的提问来源于stack exchange，提问作者user3863488