Prevent storing known root certificates

app/src/main/java/eu/faircode/email/EntityCertificate.java

@@ -234,6 +234,11 @@ public class EntityCertificate {
         return certificate.getSubjectX500Principal().getName(X500Principal.RFC2253);
     }
 
+    static boolean sameCaKey(X509Certificate a, X509Certificate b) {
+        return (a.getSubjectX500Principal().equals(b.getSubjectX500Principal()) &&
+                Arrays.equals(a.getPublicKey().getEncoded(), b.getPublicKey().getEncoded()));
+    }
+
     static List<String> getEmailAddresses(X509Certificate certificate) {
         List<String> result = new ArrayList<>();
 

app/src/main/java/eu/faircode/email/FragmentMessages.java

@@ -232,6 +232,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Comparator;
 import java.util.Date;
+import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Locale;
@@ -10488,11 +10489,23 @@ public class FragmentMessages extends FragmentBase
                                                     boolean found = false;
                                                     String issuer = (c.getIssuerDN() == null ? "" : c.getIssuerDN().getName());
                                                     EntityCertificate record = EntityCertificate.from(c, true, issuer);
-                                                    for (EntityCertificate ec : ecs)
+
-                                                        if (ec.fingerprint.equals(record.fingerprint)) {
+                                                    Enumeration<String> aliases = ks.aliases();
-                                                            found = true;
+                                                    while (aliases.hasMoreElements()) {
-                                                            break;
+                                                        Certificate certificate = ks.getCertificate(aliases.nextElement());
-                                                        }
+                                                        if (certificate instanceof X509Certificate)
+                                                            if (EntityCertificate.sameCaKey(c, (X509Certificate) certificate)) {
+                                                                found = true;
+                                                                break;
+                                                            }
+                                                    }
+
+                                                    if (!found)
+                                                        for (EntityCertificate ec : ecs)
+                                                            if (ec.fingerprint.equals(record.fingerprint)) {
+                                                                found = true;
+                                                                break;
+                                                            }
 
                                                     if (!found) {
                                                         Log.i("Storing certificate subject=" + record.subject);