Failed to trust cert when installed with ZygiskNext and LSPosed

[derodevil]

I installed a certificate and it was successfully installed to user credential. It's failed to trust user cert when ZygiskNext and LSPosed are running. I try to stop those modules, restart phone and it's successfully trusted to system credential. Unfortunately, when the phone reboots to run LSPosed and ZygiskNext the cert is missing from system credential. It won't be able to trust unless the LSPosed and ZygiskNext are stopped.

I'm using KSU Next on Android 15 HyperOS 2.0.5.0 kernel 6.6.30

[Thomasjbeavan]

Thanks for the detailed explanation — this is a nuanced issue involving Android's certificate trust store and root-level modifications via ZygiskNext and LSPosed. Here's what's likely happening and how you might address it:

---

🔍 What's Going On?

• User Credential Store vs. System Credential Store:

  • Certificates installed via Settings go to the user credential store, which apps don't trust by default unless explicitly configured.
  • The system credential store is trusted by all apps, but modifying it requires root access.

• ZygiskNext and LSPosed:

  • These modules hook into the Android runtime (Zygote) and can interfere with system-level operations, including certificate injection or trust evaluation.
  • Zygisk (part of Magisk) can isolate or hide root modifications from apps, which may prevent the system from recognizing or persisting changes to the system trust store.

• Your Observation:

  • When ZygiskNext and LSPosed are disabled, the certificate is trusted (likely because it’s successfully injected into the system store).
  • When they are re-enabled and the device reboots, the certificate disappears — suggesting that either:
    • The system store is being reset or not persisted due to module interference.
    • The modules are sandboxing or blocking access to the modified system store.

---

🛠️ Potential Solutions

1. Move the Certificate to the System Store Manually:

   • Place the .crt or .pem file in /system/etc/security/cacerts/ (or /system/etc/security/cacerts_google/ on newer Android versions).
   • Rename it to a hash-based filename (e.g., 9a5ba575.0) and set permissions to 644.
   • Reboot the device.
   • Note: This requires remounting /system as read-write and may be undone by Zygisk or LSPosed unless excluded.

2. Use Magisk Module for Systemless Certificate Injection:

   • Consider using a module like MagiskTrustUserCerts or Move Certificates to copy user certs to the system store in a systemless way.
   • These modules are designed to work with Zygisk and persist across reboots.

3. Configure LSPosed/Zygisk to Exclude Certificate-Related Processes:

   • Try disabling LSPosed hooks for system_server or any security-related services.
   • In Magisk, configure Zygisk denylist to exclude certificate management apps or services.
   • This may prevent interference with the system trust store.

4. Check for SELinux or Overlay Conflicts:

   • If SELinux is enforcing, it may block changes to the system store.
   • Some ROMs use dynamic partitions or overlayfs, which can revert changes on reboot unless handled properly.

---

⚠️ Caution

• Modifying the system trust store can have security implications.
• Always back up your device before making changes to /system.
• Be cautious with modules that alter core system behavior — they can cause boot loops or instability.

---

Would you like help crafting a Magisk module or script to automate cert injection at boot?