title: Android SSL Certificate storage while using WebViewClient
body: <p>When connecting to a secure SSL server, where is the SSL certificate stored in the Android device when we are using Android <code>WebViewClient</code> class? </p>
  
  <p>Based on my testing, this seem to be different from the device certificate store, which is <code>/system/etc/security/cacerts.bks</code></p>
  
  <p>This conclusion is from the following steps that I followed:</p>
  
  <ol>
  <li><p>Connect using class that extends WebViewClient, overiding the method below</p>
  
  <pre><code>public void onReceivedSslError(WebView view, SslErrorHandler handler,SslError error) {
      // method to show an alert box. on User accept, call handler.proceed()
  }
  </code></pre></li>
  <li><p>Alert box is shown only once during the first connection to server. After that if we connect again, then it is not shown. That tells that the certificate is stored internally by the user agent.</p></li>
  <li><p>After (2), if we use the Android URLConnection to connect to server, setting the trustmanager in a way that untrusted certificate will issue exception.</p></li>
  </ol>
  
  <p>Some code for (3):</p>
  
  <p>a)</p>
  
  <pre><code>context.init(managers, new TrustManager[] {
      new MyX509TrustManager(null) }, new SecureRandom());
  //using null for keystore, android will set trustStore to point to cacerts.bks file
  </code></pre>
  
  <p>b) Inside MyX509TrustManager:</p>
  
  <pre><code>       public void checkServerTrusted(X509Certificate[] certificates, String authType) throws CertificateException {  
          if ((certificates != null) &amp;&amp; (certificates.length == 1)) {
  
              try {
                  standardTrustManager.checkServerTrusted(certificates, authType);
              } catch (CertificateException certException) {                  
                  certException.printStackTrace();
              }
          }  
      }  
  </code></pre>
  
  <p>It is found that during (3), we get exception:</p>
  
  <pre><code>java.security.cert.CertPathValidatorException: TrustAnchor for CertPath not found
  </code></pre>
  
  <p>Now, if the user agent accepted the certificate and stored it internally, shouldn't it be used by the Android URLConnection while connecting to server. If not, then certificate was not stored in the device cert store but locally in the application (user agent) store.       </p>