Removing the CC certificate on Xiaomi: a security guide

Modern Xiaomi and Redmi smartphones are based on the Android operating system, which has a complex security architecture. One key element of this protection is the certificates of the CA (Certification Centers), which allow the device to verify the authenticity of sites and applications. However, in some cases, users face the need to delete or deactivate such certificates, especially if they were installed manually to intercept traffic or if a suspicious root certificate appeared in the system.

Having an extra or compromised certificate in a trusted repository can cause a device to ignore security warnings or block access to legitimate resources, a particularly relevant issue for those who have previously set up traffic sniffers or used corporate access profiles. It is important to understand that removing system certificates requires caution, as it can affect the operation of Google Play and banking applications.

In this guide, we will detail how to find, verify and remove unnecessary certificates on MIUI and HyperOS smartphones. We will look at standard methods through security settings, working with superuser rights and how to clean the cache of network settings. Proper management of trusted root certificates is a basic skill for ensuring data privacy on your device.

What are CC certificates and why remove them

A CC certificate is a digital document that confirms the authenticity of another digital record. In the context of Android, it is a mechanism that allows a phone to understand which software publisher or website can be trusted. By default, the system pre-installed a set of root certificates from major global companies, but a user or malware can add their records to it.

The main reason to remove is because you suspect you have a spyware application or have to reset your network security settings after testing. If a root certificate that you don't know appears on the list of trusted objects, it's a signal of a potential vulnerability. Attackers can use fake certificates to conduct Man-in-the-Middle attacks, intercepting your traffic on public Wi-Fi networks.

⚠️ Note: Removal of system certificates required for Google services or MIUI, It can lead to authorization errors and the inability to run standard applications.

In addition, some banking applications and corporate clients require a clean environment, and if user security certificates are found in the system, software may refuse to run for data protection purposes, so cleaning the storage is often a must before using sensitive financial instruments on a root-enabled device or after deep customization.

Diagnostics: verification of established certificates

Before taking action, an audit of the current security status is required. In the MIUI shell, the path to managing certificates can be hidden in the depth of the menu or accessed through the search box. The standard interface allows you to view a list of trusted root centers, but does not always allow you to edit them without special rights.

To start with, you should check the settings section that's associated with encryption and credentials, and that's where the access keys are stored. If you've previously installed traffic analytics applications like HttpCanary or Packet Capture, they might have added their roots to the system, and you should also look at certificates installed through device profiles (MDMs), which are often used in the enterprise environment.

• 🔍 Go to Settings. → Passwords and security → Privacy for finding network settings.
• 📱 Use the search bar in the settings by entering the request "certificate" or "trusted persons".
• 🛡️ Please note the section "Encryption and credentials" where user keys are stored.

It is important to distinguish between system and user certificates: System certificates are protected from deletion by conventional methods, while user certificates can be manually deleted. If you see a certificate with a name that is unfamiliar to you and that does not belong to well-known companies like Google, Let's Encrypt or DigiCert, this is a reason for a deeper analysis of its origin and purpose.

Removing User Certificates through Settings

The safest and easiest way to clean up is to use the standard Android interface, which is suitable for removing certificates that have been added by you personally or by apps with your consent, the procedure does not require superuser rights and minimizes the risk of system damage.

To perform the operation, you need to find the credentials management menu. The location may vary slightly between Android and MIUI versions, but the logic remains the same. You need to find a list of user certificates and select the deletion option for each suspicious item.

The sequence of actions usually goes like this: open settings, find the security section, go to encryption and credentials. There will be a tab "User" or "Trusted." When you select an unnecessary object, click the delete button. The system will request confirmation of your identity through a pin code, a pattern lock or a fingerprint.

If you reboot your device after you delete it, the changes will take effect immediately, applications that depend on the remote certificate will stop working correctly, which is the desired effect if the purpose was to clear the surveillance, but be prepared for the fact that some corporate resources may become unavailable if you delete your work profile.

Work with system certificates and Root rights

This is complicated when a malicious or unnecessary certificate is embedded in a system partition. Normally, Android cannot delete it because the /system partition is read-only. The changes require root rights and a dedicated file manager, such as a Root Explorer or a MiXplorer with superuser rights.

The process involves moving or deleting certificate files from system directories, most often they are on the path /system/etc/security/cacerts or /apex/com.android.conscrypt/cacerts. Before any manipulation, it is critical to create a full backup of the source files so that in case of an error, the system can be restored to work.

Using a root file manager allows you to rename the certificate file by adding the.bak extension, or delete it completely. After that, you need to change the access rights (chmod) for the remaining files if the system requires it, and be sure to restart the device. Incorrect change of rights can lead to a cyclic restart (bootloop).

Using ADB to clean storage

For advanced users who don’t want to get root rights, there is an alternative method through USB debugging and the ADB (Android Debug Bridge) utility, which allows you to manage certain aspects of security and remove user certificates by software without the graphical interface.

First, you need to activate the developer mode on the Xiaomi smartphone, and you need to click on the build number several times in the About section. Then the developer menu turns on USB debugging. Once you connect to the computer and authorize the device, you can execute commands.

adb shell pm grant com.android.certinstaller android.permission.WRITE_SECURE_SETTINGS

However, it is worth noting that direct removal of system certificates through ADB without root is not possible due to the security limitations of the Linux kernel. ADB is effective for resetting network settings or forcing user storage to be cleaned if the interface is blocked. Network reset commands can indirectly help in cleaning the certificate cache.

This method requires careful input. A syntax error can cause a command to fail, but it's hard to damage the system unless you use commands to write to system partitions directly. Always check the syntax of commands in the official Android documentation.

Resetting network settings and factory reset

If manual deletion fails or the system is unstable, more radical measures can be taken: Network resetting is a gentle option that removes stored Wi-Fi passwords, Bluetooth settings, and, importantly, resets network certificates to default.

The path to this feature is usually in Settings → Connection and Sharing → Reset Wi-Fi, mobile networks and Bluetooth.This operation does not affect personal files, photos or installed applications, but returns network configurations to their original state, removing all user add-ons.

• 🔄 Network reset removes all stored Wi-Fi access points.
• 📡 Mobile communication settings are reset (APN) factory-to-factory.
• 🗑️ All user security certificates are removed.

In extreme cases, if a malicious certificate is suspected to be embedded in the system, only a full Factory Reset helps, which is guaranteed to delete all user data and return the MIUI software to its original state.

FAQ: Frequently Asked Questions

💡

Full reset to factory settings is the only guaranteed way to remove hidden system modifications to certificates without flashing them.