# Android Certificate Installation Guide

**MCP Cross-Platform Certificate Setup for Android Devices**  
*Author: claude-code-Certificate-Specialist-2025-09-03*

This guide explains how to install the Windows server's mkcert CA certificate on Android devices to enable secure HTTPS connections to the MCP coordination system.

## Overview

Android devices need to trust the Certificate Authority (CA) that issued the Windows server's HTTPS certificate. This guide walks through installing the mkcert CA certificate on Android devices.

## Prerequisites

1. **Windows Server Setup Complete**: Run `setup-ssl-windows.bat` on the Windows machine
2. **CA Certificate Available**: The `mkcert-ca-cert.pem` file generated by the Windows setup
3. **Network Connectivity**: Android device can reach the Windows server IP address
4. **Android Device**: Running Android 4.0+ (API level 14+)

## Step-by-Step Installation

### Step 1: Transfer CA Certificate to Android

#### Option A: USB Transfer
1. Connect Android device to computer via USB
2. Copy `mkcert-ca-cert.pem` from Windows to Android device
3. Place file in `Downloads` folder or accessible location

#### Option B: Cloud Transfer
1. Upload `mkcert-ca-cert.pem` to Google Drive, Dropbox, or email
2. Download on Android device
3. Note the download location

#### Option C: Network Transfer
```bash
# From Windows server, start a simple file server
cd mcp-coordination-system/certs
python -m http.server 8000

# On Android browser, navigate to:
# http://[WINDOWS_IP]:8000/mkcert-ca-cert.pem
# Download the file
```

### Step 2: Install Certificate on Android

#### For Android 11+ (Recommended Method)
1. Open **Settings** app
2. Navigate to **Security** → **Encryption & credentials** 
   - Or **Biometrics and security** → **Other security settings**
   - Path varies by Android version and manufacturer
3. Tap **Install a certificate**
4. Choose **CA certificate**
5. When prompted, confirm you want to install a CA certificate
6. Browse to the downloaded `mkcert-ca-cert.pem` file
7. Select the file and tap **Open**
8. Enter a name for the certificate (e.g., "MCP Server CA")
9. Tap **OK** to install

#### For Android 10 and Earlier
1. Open **Settings** app
2. Go to **Security & location** → **Advanced** → **Encryption & credentials**
3. Tap **Install from storage** or **Install certificates**
4. Choose **CA certificate**
5. Navigate to the downloaded certificate file
6. Select `mkcert-ca-cert.pem`
7. Provide a certificate name when prompted
8. Tap **OK** to complete installation

#### Alternative: Using File Manager
1. Open your file manager app
2. Navigate to the downloaded `mkcert-ca-cert.pem` file
3. Tap on the certificate file
4. Android should prompt to install the certificate
5. Follow the installation prompts

### Step 3: Verify Installation

#### Check Installed Certificates
1. Go to **Settings** → **Security** → **Encryption & credentials**
2. Tap **Trusted credentials** 
3. Switch to **User** tab
4. Look for your installed MCP certificate
5. Tap on it to view details

#### Test HTTPS Connection
1. Open Chrome browser on Android
2. Navigate to: `https://[WINDOWS_SERVER_IP]:3444/health`
   - Replace `[WINDOWS_SERVER_IP]` with your Windows machine's IP
   - Example: `https://192.168.0.171:3444/health`
3. If successful, you should see server status JSON
4. No certificate warnings should appear

## Troubleshooting

### Certificate Installation Issues

**Problem**: "Can't read certificate" error
- **Solution**: Ensure file is named with `.pem` or `.crt` extension
- **Solution**: Try renaming `mkcert-ca-cert.pem` to `mkcert-ca-cert.crt`

**Problem**: Certificate option not visible in Settings
- **Solution**: Check different paths: Security → Advanced → Credentials
- **Solution**: Use file manager to tap certificate directly
- **Solution**: Try Settings → Lock screen and security → Other security settings

**Problem**: Installation appears to succeed but connection still fails
- **Solution**: Restart the Android device after certificate installation
- **Solution**: Clear browser cache and try again
- **Solution**: Verify Windows server is running and accessible

### Connection Issues

**Problem**: "This site can't be reached"
```bash
# Test basic connectivity from Android terminal app
ping [WINDOWS_SERVER_IP]
telnet [WINDOWS_SERVER_IP] 3444
```

**Problem**: "Certificate error" or "Not secure" warnings
- Verify CA certificate was installed in **User** credentials (not Device)
- Check certificate details match the server certificate
- Ensure Windows server is using the mkcert certificates

**Problem**: Connection works in Chrome but not in MCP client apps
- Some apps use system certificate store differently
- Try testing with multiple browsers first
- Consider using HTTP for development if HTTPS causes issues

## Security Considerations

### Production Deployment
- **Development Only**: mkcert certificates are for development/testing only
- **Production**: Use properly signed certificates from trusted CAs
- **Network Security**: Ensure network traffic is on trusted networks

### Certificate Management
- **Removal**: To remove certificate, go to Settings → Security → Trusted credentials → User tab
- **Expiration**: mkcert certificates typically expire after 2+ years
- **Rotation**: Generate new certificates when needed

## Advanced Configuration

### Multiple IP Addresses
If the Windows server has multiple IP addresses:
```batch
REM On Windows, generate certificates for all IPs
mkcert localhost 127.0.0.1 192.168.0.171 192.168.1.100 10.0.0.50
```

### Port Forwarding Setup
For remote access through router:
1. Configure router to forward external port to Windows server port 3444
2. Generate certificate including external IP:
```batch
mkcert localhost 127.0.0.1 [LOCAL_IP] [EXTERNAL_IP]
```
3. Android can then connect via external IP

### Corporate Network Considerations
- **Firewall Rules**: Ensure port 3444 is allowed through corporate firewalls
- **WiFi Networks**: Both devices should be on same network or properly routed
- **VPN Access**: Consider VPN if devices are on different networks

## Testing Checklist

- [ ] CA certificate successfully installed on Android
- [ ] Certificate visible in Settings → Security → Trusted credentials → User
- [ ] Windows MCP server running with HTTPS enabled
- [ ] Network connectivity confirmed (ping test)
- [ ] HTTPS connection successful in Android browser
- [ ] No certificate warnings or errors
- [ ] Server health endpoint returns JSON response
- [ ] Ready for MCP client configuration

## Example MCP Client Configuration

Once HTTPS is working, configure your Android MCP client:
```json
{
  "server_url": "https://192.168.0.171:3444",
  "verify_ssl": true,
  "timeout": 30000
}
```

## Additional Resources

- **mkcert Documentation**: https://github.com/FiloSottile/mkcert
- **Android Certificate Management**: https://support.google.com/android/answer/2819522
- **MCP Specification**: https://spec.modelcontextprotocol.io/

---

## Summary

This guide enables Android devices to securely connect to Windows-hosted MCP servers using mkcert certificates. The process involves:

1. **Certificate Transfer**: Moving the CA certificate from Windows to Android
2. **System Installation**: Installing the CA certificate in Android's trust store  
3. **Connection Testing**: Verifying HTTPS works without certificate errors
4. **Client Configuration**: Setting up MCP clients to use the secure connection

After completing these steps, Android apps can securely connect to the Windows MCP server without certificate warnings or connection errors.