From afdfccd2748c666e5bd96c7254da3c342caa15c9 Mon Sep 17 00:00:00 2001
From: Dirk Hohndel <dirk@hohndel.org>
Date: Wed, 13 Oct 2021 23:15:58 +0000
Subject: [PATCH] Android: allow user installed root certificates

On Android devices that no longer get updates to the system installed
SSL root certificates, the user can easily install the updated Let's
Encrypt root certificate, but that is only used by Subsurface-mobile if
we explicitly allow the use of those user installed root certificates.

Fixes #3335

Suggested-by: Greg Hunter
Signed-off-by: Dirk Hohndel <dirk@hohndel.org>
---
 android-mobile/AndroidManifest.xml                 | 3 ++-
 android-mobile/res/xml/network_security_config.xml | 9 +++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)
 create mode 100644 android-mobile/res/xml/network_security_config.xml

diff --git a/android-mobile/AndroidManifest.xml b/android-mobile/AndroidManifest.xml
index 6c3a09d3f..67ce4bc8d 100644
--- a/android-mobile/AndroidManifest.xml
+++ b/android-mobile/AndroidManifest.xml
@@ -10,7 +10,8 @@
         android:hardwareAccelerated="true"
         android:label="@string/app_name"
         android:extractNativeLibs="true"
-        android:icon="@drawable/subsurface_mobile_icon" >
+        android:icon="@drawable/subsurface_mobile_icon"
+        android:networkSecurityConfig="@xml/network_security_config" >
         <activity
             android:name="org.subsurfacedivelog.mobile.SubsurfaceMobileActivity"
             android:configChanges="orientation|uiMode|screenLayout|screenSize|smallestScreenSize|layoutDirection|locale|fontScale|keyboard|keyboardHidden|navigation|mcc|mnc|density"
diff --git a/android-mobile/res/xml/network_security_config.xml b/android-mobile/res/xml/network_security_config.xml
new file mode 100644
index 000000000..58354b7df
--- /dev/null
+++ b/android-mobile/res/xml/network_security_config.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+			<certificates src="system" />
+			<certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>