Skip to content
  • There are no suggestions because the search field is empty.

Importing Certificates

A certificate for a Wi-Fi network can be refused with a wrong password error when the password is right. This is not a password problem and retyping it will not help.

Why it happens

Android does not accept PKCS12 files that use the newer encryption algorithms, which is what modern tools produce by default. It reports the file it cannot decrypt as a bad password, which sends you looking in the wrong place.

The fix is to re-export the certificate using the older encryption the device does accept. Nothing about the certificate itself changes.

Converting the certificate

You need OpenSSL on a computer, not on the device.

  1. Convert the PFX file to PEM:
    openssl pkcs12 -nodes -in certificate.pfx -out output_certificate.pem
  2. Convert it back to PFX with the older encryption:
    openssl pkcs12 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -export -in output_certificate.pem -out new_certificate.pfx -name "new-certificate"

The second command offers to set a password. Set one if the certificate needs it.

Import new_certificate.pfx on the device in the usual way.

Handling the intermediate file

The PEM file the first command produces holds the private key unencrypted. Delete it once you have the new PFX, and do not leave it on a shared machine or send it anywhere.