fix(mobile): trust user-installed Android CA certificates (#25730)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: juliusmarminge

apps/mobile/app.config.ts

@@ -425,7 +425,7 @@ const config: ExpoConfig = {
     ["expo-sensors", { motionPermission: false }],
     // Mods run in reverse order; expo-widgets must create and wipe the target before assets are added.
     ...(!isIosPersonalTeamBuild ? ["./plugins/withWidgetLogoAsset.cjs", widgetsPlugin] : []),
-    "./plugins/withAndroidCleartextTraffic.cjs",
+    "./plugins/withAndroidNetworkSecurityConfig.cjs",
     "./plugins/withAndroidGradleHeap.cjs",
     "./plugins/withAndroidInputBackground.cjs",
     "./plugins/withAndroidModernPopupMenu.cjs",

apps/mobile/plugins/withAndroidCleartextTraffic.cjs

@@ -0,0 +1,56 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { withAndroidManifest, withDangerousMod } = require("expo/config-plugins");
+
+// Environments behind a private CA installed in the user store must work like they do in Chrome.
+// Android ignores usesCleartextTraffic once a network security config exists, so permit it here.
+const NETWORK_SECURITY_CONFIG = `<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+  <base-config cleartextTrafficPermitted="true">
+    <trust-anchors>
+      <certificates src="system" />
+      <certificates src="user" />
+    </trust-anchors>
+  </base-config>
+</network-security-config>
+`;
+
+function withNetworkSecurityConfigManifest(config) {
+  return withAndroidManifest(config, (nextConfig) => {
+    const application = nextConfig.modResults.manifest.application?.[0];
+
+    if (application == null) {
+      throw new Error(
+        "AndroidManifest.xml is missing the application element required for network security configuration.",
+      );
+    }
+
+    application.$ ??= {};
+    application.$["android:networkSecurityConfig"] = "@xml/network_security_config";
+
+    return nextConfig;
+  });
+}
+
+function withNetworkSecurityConfigResource(config) {
+  return withDangerousMod(config, [
+    "android",
+    async (config) => {
+      const xmlDir = path.join(
+        config.modRequest.platformProjectRoot,
+        "app",
+        "src",
+        "main",
+        "res",
+        "xml",
+      );
+      fs.mkdirSync(xmlDir, { recursive: true });
+      fs.writeFileSync(path.join(xmlDir, "network_security_config.xml"), NETWORK_SECURITY_CONFIG);
+      return config;
+    },
+  ]);
+}
+
+module.exports = function withAndroidNetworkSecurityConfig(config) {
+  return withNetworkSecurityConfigResource(withNetworkSecurityConfigManifest(config));
+};

apps/mobile/plugins/withAndroidNetworkSecurityConfig.cjs

@@ -62,6 +62,10 @@ On a computer with the desktop app, you can open the printed `t3code://pair`
 app link instead. The desktop app asks you to confirm the server address, then
 adds it.
 
+If your HTTPS endpoint uses a certificate from your own certificate authority,
+install that CA on Android as a **CA certificate** in its security settings; the
+Android app then trusts it.
+
 Pairing authorizes that device for future connections. Use a fresh one-time link
 for each new device; you do not need the original token to reconnect. Links
 created in Settings can only be copied from the client that created them while