From 6f1867e47a981983b9d65cb0638230278d5c33d8 Mon Sep 17 00:00:00 2001
From: M66B <M66B@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:05:46 +0200
Subject: [PATCH] Prevent storing known root certificates

---
 .../eu/faircode/email/EntityCertificate.java  |  5 ++++
 .../eu/faircode/email/FragmentMessages.java   | 23 +++++++++++++++----
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/app/src/main/java/eu/faircode/email/EntityCertificate.java b/app/src/main/java/eu/faircode/email/EntityCertificate.java
index a5d522e6de..d4d4cc29a1 100644
--- a/app/src/main/java/eu/faircode/email/EntityCertificate.java
+++ b/app/src/main/java/eu/faircode/email/EntityCertificate.java
@@ -234,6 +234,11 @@ public class EntityCertificate {
         return certificate.getSubjectX500Principal().getName(X500Principal.RFC2253);
     }
 
+    static boolean sameCaKey(X509Certificate a, X509Certificate b) {
+        return (a.getSubjectX500Principal().equals(b.getSubjectX500Principal()) &&
+                Arrays.equals(a.getPublicKey().getEncoded(), b.getPublicKey().getEncoded()));
+    }
+
     static List<String> getEmailAddresses(X509Certificate certificate) {
         List<String> result = new ArrayList<>();
 
diff --git a/app/src/main/java/eu/faircode/email/FragmentMessages.java b/app/src/main/java/eu/faircode/email/FragmentMessages.java
index 6a1083013f..7d98f17ad3 100644
--- a/app/src/main/java/eu/faircode/email/FragmentMessages.java
+++ b/app/src/main/java/eu/faircode/email/FragmentMessages.java
@@ -232,6 +232,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Comparator;
 import java.util.Date;
+import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Locale;
@@ -10488,11 +10489,23 @@ public class FragmentMessages extends FragmentBase
                                                     boolean found = false;
                                                     String issuer = (c.getIssuerDN() == null ? "" : c.getIssuerDN().getName());
                                                     EntityCertificate record = EntityCertificate.from(c, true, issuer);
-                                                    for (EntityCertificate ec : ecs)
-                                                        if (ec.fingerprint.equals(record.fingerprint)) {
-                                                            found = true;
-                                                            break;
-                                                        }
+
+                                                    Enumeration<String> aliases = ks.aliases();
+                                                    while (aliases.hasMoreElements()) {
+                                                        Certificate certificate = ks.getCertificate(aliases.nextElement());
+                                                        if (certificate instanceof X509Certificate)
+                                                            if (EntityCertificate.sameCaKey(c, (X509Certificate) certificate)) {
+                                                                found = true;
+                                                                break;
+                                                            }
+                                                    }
+
+                                                    if (!found)
+                                                        for (EntityCertificate ec : ecs)
+                                                            if (ec.fingerprint.equals(record.fingerprint)) {
+                                                                found = true;
+                                                                break;
+                                                            }
 
                                                     if (!found) {
                                                         Log.i("Storing certificate subject=" + record.subject);