adguard cert does not work with work profile

[christaikobo]

Please answer the following questions for yourself before submitting an issue.

• I am running the latest version
• I checked the documentation and found no answer
• I checked to make sure that this issue has not already been filed

AdGuard version

4.1

Environment

- OS: Android 12
- Device: Xperia 5 II
- Firmware: Latest

Root access

• Yes, I have it.

What filters do you have enabled?

No response

What Stealth Mode options do you have enabled?

No response

Issue Details

The adguard cert seems to only move the last cert to system store.

This leaves a problem, if someone enables work profile, there will be 2 certs, either both in /data/misc/user/0/cacerts-added, or in /data/misc/user/0/cacerts-added and /data/misc/user/10/cacerts-added respectively and adguard only seems to move one of them to the system store.

P.S. If both of them are in /data/misc/user/0/cacerts-added, one of them will end with .1 instead of .0

Expected Behavior

Both regular user (0) and work profile user can have certificates in the system store.

Actual Behavior

For regular user(0) and work profile user, only one of them can have certificate in system store.

Screenshots

Screenshot 1:

Additional Information

No response

[Versty]

@TerryTW Hi!
Please check if the issue persists on the latest nightly version. We have made some tweaks to the certificates installation flow recently.

[christaikobo]

Dear Diana,

Can you please confirm which verison of adguardcert module should I be using in combination with the lastest nightly Adguard Android? Should I use v2.0-beta4?

[Versty]

@TerryTW Yes, please use this version

[christaikobo]

@Versty Dear Diana,

I have tried the latest nightly and adguardcert 2.0 beta4, and the problem persists.

If it helps, you can have the dev try https://play.google.com/store/apps/details?id=com.oasisfeng.island&hl=en_US on your test devices to create work profile and see for yourself.

The issue is actually quite straight forward, basically:

1. You can not install cert into work profile's user store, you can only install it in the default user's user store;
2. All users share the same system store.
3. adguardcert module only copies one cert into the system store.

I have no idea how the intermediate cert schematic works. I hope you guys can figure out a way to make it work.
For now I manually move cert from user 0's user store to user 10's user store, and use a modified https://github.com/ngorskikh/adguardcert (cp instead of mv) to address the issue.

[Versty]

@TerryTW At this point, certificates work in pair. If one of them is in the system store, the second one must be in the user store for correct HTTPS filtering.

adguardcert module only copies one cert into the system store.

Therefore, this behaviour is intended.

[christaikobo]

@Versty Yes, I know it is intended, which creates a legitimate problem: https filtering does not work in work profile.

[Versty]

@TerryTW We have discussed this issue with developers and transferred it to the appropriate repository.

[christaikobo]

@Versty Dear Diana, any update? I saw that you assigned someone then removed the assignment later. Not asking any ETA, just want to know whether this is still being worked on.

[GodlikeRU]

This is still a problem but I found a workaround. You need root.

1. Using root file manager go to /data/misc/user/0/cacerts-added - this folder contains two adguard certificates installed on your main profile
2. Copy these two into /data/misc/user/999/cacerts-added - this folder is for work profile certs
3. Also copy certs to /system/etc/security/certs - this is system wide cert store
4. Reboot
5. After rebooting there will be notification that new certificates were installed for work profile
6. Adguard cert will now work properly on work profile allowing system wide https filtering in auto proxy root mode. It also works properly with VPN at same time

[christaikobo]

Yes I have figured it out as well, thank you for sharing anyway.
Problem is that after Android 11, even with root permission you cannot write to system partition.
I have modified movecert module myself to achieve this.
It is just kinda disappointing that the devs just ignored this.

[GodlikeRU]

@TerryTW please share the modified module. It may help people with same problem. and I agree, it's disappointing we still don't have fix from Adguard team. Work profile is getting more and more popular and this will affect more and more people. On Android 10 the above method worked.