Chrome ERR_CERTIFICATE_TRANSPARENCY_REQUIRED with the second Android user

[PiRomant]

Another Android user on the same device gets an error ERR_CERTIFICATE_TRANSPARENCY_REQUIRED in the Chrome.

In the meantime, there is a way to work around this: you can manually modify the flags used by Chrome, to explicitly trust your specific CA certificate, in addition to installing it the system store, thereby disabling certificate transparency checks.

You can do this using the --ignore-certificate-errors-spki-list=<cert hash> option. This is available on all platforms, but it's a bit tricky to set on Android, since you don't directly control how Chrome starts up. To enable this, you need to:

1. Get the SPKI fingerprint of your certificate. You can do so using this OpenSSL magic incantation:>
   openssl x509 -in $YOUR_CA_CERTIFICATE -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

2. Create a file containing one line:
   chrome --ignore-certificate-errors-spki-list=$YOUR_SPKI_FINGERPRINT

3. Use adb push to store this on your Android device at:

/data/local/chrome-command-line
/data/local/android-webview-command-line
/data/local/webview-command-line
/data/local/content-shell-command-line
/data/local/tmp/chrome-command-line
/data/local/tmp/android-webview-command-line
/data/local/tmp/webview-command-line
/data/local/tmp/content-shell-command-line

This ensures it applies for all varieties of Chromium, in both normal & debug environments. You'll need root access to set the non-tmp files, which is what's used on production devices (while the tmp files are used by userdebug builds).

4. Set the permissions of each the above with chmod 555 <filename> to ensure that it's readable by Chromium when it starts.
5. Force stop Chrome (am force-stop com.android.chrome), and then open it again.
6. Check the command line flags shown on chrome://version to ensure this command line option is included there.

https://httptoolkit.com/blog/chrome-android-certificate-transparency/#how-to-fix-it
https://habr.com/ru/company/globalsign/blog/666046/