Move Certificate

Magisk KSU APatch

Intercepting and decrypting HTTPS traffic on modern Android devices is notoriously difficult due to strict certificate trust policies. Move Certificate by ys1231 elegantly solves this problem. Engineered as a highly efficient, systemless module, it automatically identifies user-installed certificates—such as those generated by AdGuard, HttpCanary, Charles Proxy, or Burp Suite—and seamlessly injects them into the heavily restricted system credential store. Fully optimized for Magisk, KernelSU, and APatch, this tool is indispensable for developers, security researchers, and privacy enthusiasts.

Unrestricted HTTPS Decryption

Bypass Android's restrictive network security configurations. Ensure your adblockers and packet sniffers can inspect secure app traffic flawlessly, all via systemless mounting.

Automated Migration

You don't need to manually move files via root explorers. Install your certificate normally through Android's security settings, reboot, and the module handles the complex migration to the system store automatically.

Android 14+ APEX Support

Modern Android versions locked the root certificate store inside an immutable Conscrypt APEX container. This module utilizes advanced overlay techniques to bypass the APEX barrier safely and effectively.

AdGuard & Proxy Ready

Essential for tools that rely on Man-in-the-Middle (MITM) interception. Without system-level trust, modern apps will drop connections to your proxy. This module completely restores HTTPS filtering capabilities.

Universal Systemless Architecture

Weighing just over 500 KB, the script relies strictly on temporary memory mounts (tmpfs). It integrates natively across Magisk, KernelSU, and APatch, ensuring your actual partitions remain unadulterated.

How Systemless Certificate Injection Works

On Android 7.0+, Google changed the default Network Security Configuration so that apps ignore the User certificate store. Furthermore, starting in Android 14, the System store was moved from the writable /system partition into an unmodifiable APEX module (/apex/com.android.conscrypt/cacerts).

Move Certificate bypasses these roadblocks by executing a highly specialized shell script during the post-fs-data boot phase.

# Conceptual Execution Flow of the Module:
# Step 1: Clone the secure Conscrypt APEX certificates to a temporary RAM disk.
cp -a /apex/com.android.conscrypt/cacerts/* /data/local/tmp/custom_cacerts/
# Step 2: Copy the user-installed certificates into the cloned directory.
cp -a /data/misc/user/0/cacerts-added/* /data/local/tmp/custom_cacerts/
# Step 3: Bind-mount the populated RAM disk directly over the APEX and System paths.
mount --bind /data/local/tmp/custom_cacerts /apex/com.android.conscrypt/cacerts
mount --bind /data/local/tmp/custom_cacerts /system/etc/security/cacerts

The operating system is seamlessly tricked into viewing your custom certificates (like AdGuard or Charles Proxy) as pre-installed Google-verified system certificates. Once you reboot the device, the injection is complete, and the memory mounts disappear entirely upon uninstall.

Frequently Asked Questions

Move Certificate is a powerful systemless root module developed by ys1231 and contributors. It automatically detects certificates installed in the Android "User" store and binds them into the "System" certificate store during boot.

Starting from Android 7.0 (Nougat), apps no longer trust user-installed certificates by default for secure (HTTPS) connections. If you use ad-blockers like AdGuard, or network inspection tools like Burp Suite and Charles Proxy, moving their certificates to the system level is mandatory to intercept and filter secure app traffic.

Yes! Modern Android versions moved the system certificates from the traditional /system/etc/security/cacerts directory into an unmodifiable Conscrypt APEX module. This module features updated mounting logic to bypass this restriction, making it fully compatible with Android 14+.

No. This module utilizes pure systemless bind-mounting. Your physical system blocks and APEX modules remain 100% factory-sealed, ensuring SafetyNet/Play Integrity is not broken by partition tampering.

Absolutely. The script has been thoroughly updated by contributors to detect and execute the correct overlay logic depending on whether you are using Magisk, KernelSU, or APatch.

Module Info

  • Version v1.5.7
  • Module By
    Contributors
  • Contributors ys1231, SafaSafari, fr0stb1rd
  • Source Code View Repository
  • Tags
    #Move Certificate #ys1231 #HTTPS Decryption #System Certificate #Burp Suite #AdGuard #Magisk Module #KernelSU #APatch #Systemless
  • Requirement
    Magisk KernelSU APatch
  • Latest Update