The issue with Android 10 devices failing to work after a new CA certificate is installed, particularly when the certificate is in the user folder instead of the system folder, is due to Android's stricter certificate trust policies.

Starting with Android 10, applications no longer trust certificates from the user-added certificate store by default. Certificates must be in the system store to be trusted by applications unless additional configuration is made in the app.

To resolve this issue for your OutSystems app, follow these steps:

1. Move the Certificate to the System Store

• Certificates must be installed in the system store to be automatically trusted by Android apps.
• This generally requires root access to the Android device, as modifying the system store isn't possible without elevated permissions. If you have access to a rooted device or can deploy the certificate via a mobile device management (MDM) solution, move the certificate to the system store.

2. Configure Network Security in the App

If moving the certificate to the system store is not an option, you can configure the app to trust user-installed certificates by adding a custom network_security_config.xml file. Here's how:

• Open your OutSystems app in Service Studio.

• Add an override file for the Network Security Configuration by following the steps outlined in the OutSystems documentation.

• Define the configuration to trust certificates in the user store. For example:

  <?xml version="1.0" encoding="utf-8"?>
  <network-security-config>
    <domain-config cleartextTrafficPermitted="true">
      <trust-anchors>
        <certificates src="user"/>
        <certificates src="system"/>
      </trust-anchors>
    </domain-config>
  </network-security-config>
  

• Publish the updated app and rebuild the APK or AAB files.

3. Ensure the Certificate Chain is Valid

Android devices validate the entire certificate chain. If there are intermediate certificates that aren’t installed on the server or the devices, the app may fail to connect even if the root certificate is trusted. Make sure:

• The certificate chain (root and intermediates) is correctly configured on the server hosting the API or database being accessed by your app.
• If you're unsure how to configure this, follow steps similar to the ones described here: Add self signed certificate to trusted root store on OutSystems.

4. Test on Different Android Versions

Testing across Android versions will help confirm the issue is indeed specific to certificate policies on Android 10. If it works on devices running older Android versions but fails on Android 10+, the steps above should resolve the issue.

5. Reach Out to OutSystems Support (if needed)

If the app still fails even after applying these steps, consider opening a support ticket with OutSystems. Provide details about the CA certificate, server configuration, and devices where the issue is observed. The support team can help investigate further or provide additional solutions.

For more information on dealing with certificates in OutSystems Cloud or on-premise environments, check these articles: How OutSystems protects your Android and iOS certificates.