title: CA x.509 generated by bouncy castle is seen on Android as user certificate
body: <p>I am using following code to generate root CA:</p>
  
  <pre><code>public static X509Certificate buildRootCert(KeyPair keyPair)
  throws Exception {
      X509v1CertificateBuilder certBldr = new JcaX509v1CertificateBuilder(
      new X500Name("CN=Root"),
      BigInteger.valueOf(1),
      new Date(System.currentTimeMillis()),
      new Date(System.currentTimeMillis() + 1000 * 3600 * 24),
      new X500Name("CN=Root"), keyPair.getPublic());
  
      ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA")
      .setProvider("BC").build(keyPair.getPrivate());
  
      return new JcaX509CertificateConverter().setProvider("BC")
      .getCertificate(certBldr.build(signer));
  }
  </code></pre>
  
  <p>After that I need 2 more steps to have CA Cert</p>
  
  <ol>
  <li>Print base64 code of cert with <code>PEMWriter</code></li>
  <li>Copy output to <code>root.crt</code> file.</li>
  </ol>
  
  <p>Windows recognizes it as CA Certificate and shows warning <em>...this certifiacate is not trusted...</em>, but when I am trying to install this cert to Android it shows </p>
  
  <p><em>The package contains: one <strong>user</strong> certificate</em></p>
  
  <p>Installation is proceeded but cert is not present in user <em>trusted list</em></p>
  
  <p>Is this correct way to generate self-signed CA?</p>