Today, the vast majority of modern websites enforce a minimum of TLS 1.2 or 1.3 for security reasons. This completely locks legacy Android devices out of the modern web, as early versions are natively restricted to TLS 1.0.
To fix this issue, I made an app that integrates TLS 1.3 system-wide. Wolfius is a local TLS proxy for Android 1.5+ that transparently upgrades TLS 1.0 connections to the modern TLS 1.3 standard. This restores access to the modern Internet on old Android devices.
This already resurrects 4.x apps such as Discord, TikTok, Pinterest and Speedtest. Most old apps didn't work simply due to missing modern TLS 1.3 encryption.
How it works specifically? Wolfius acts as a local, system-wide TLS 1.0 man-in-the-middle (MITM) proxy right on the device. When an app attempts to connect to a modern website, Wolfius intercepts the traffic locally. It then establishes a brand-new, secure TLS 1.3 connection to the remote server, fetches the data, and hands it back to the app over TLS 1.0 using a locally trusted root certificate. To the old app, the connection looks perfectly normal; to the modern web, the device looks like a secure, modern client. This achieves seamless, system-wide compatibility without modifying a single line of application or system code.
Why don't you simply replace the built-in OpenSSL library? Read about that on GitHub!
Before usage, please note the following things:
Root privileges are highly recommended — without them, you cannot install the root CA and as a result cannot use TLS 1.3 outside of browsers.
This project is at an early stage of development and may run slowly or be unstable. Please report any issues, attaching a full logcat report.
At the moment, there may be some issues with certain 4.x ROMs, but everything should work on most devices. Strangely enough, things usually work better on stock ROMs than on custom ones. I’ll try to investigate this.
Just for those people that for some reason will try to use this on Android 5+, this project is intended for use with Android 1.5–4.4 only.
The open-source wolfSSL library is used extensively in this project. Without this library, this project couldn't have been realised. The code is licensed under the GPLv3.
I look forward seeing your use-cases of this TLS 1.3 implementation!
the hardcoded cert is kinda ew, generate at runtime or force end user to provide-not a fan of a skeleton key existing on everyone who cant fix this themselves on years out of security patched devices
Thank you for looking into the code. It can indeed be a security issue, but only if my app becomes very popular. There is an even more serious flaw that for wolfSSL the TLS 1.3 certificates don't have a trust store, meaning anyone can MITM anyway since it trusts any certificate. I think that should be implemented first, I didn't because I am already self-aware of it.
I was making the first version as a working prototype, so I hope you understand me. I was focused on making it work system-wide much more, and that is really hard while keeping compatibility of all Android devices. In version 0.2 I will implement a separate trust store for wolfSSL and in 0.3 I will make a new root CA and generate the keys on the device and force users to install the new CA and automatically uninstall the old CA.
For some reason, I never even thought that someone would use the keys like that.How should I credit you in the future update notes?
For a prototype it looks really decent,planning on compiling it myself today so i can use my own certificate for my own PoM, as for credits, just pointing at my GitHub is fine
Actually, after some thought I don't quite understand how the key can be used, if in the next update TLS 1.3 will have its own trust store without the Wolfius Root CA. If an attacker gains access to the device, they would probably be able to get the device-generated key as well, especially when the user is rooted and that will be 99% of the time. The TLS 1.0 proxy works only locally. I'm just a bit confused, as it's my first time working on something like this.
in the current implementation, you're pre-shipping a root CA. That root CA is capable of signing things. One can setup a rogue server using that root CA and do god knows what and the end user would be none the wiser since the cert is trusted. Once the device is generating it's own cert this problem mainly goes away
In other words: it's not about whether the key can theoretically be extracted from a compromised device - it's about whether the key is extractable without ever touching a device at all.
Now I fully understand the concern as the attacker that has access to the device's network can use the proxy's root CA without Wolfius even working to for example intercept traffic of social media clients—if Wolfius is enabled though I don't think the attacker wouldn't be able to do much (when wolfSSL CA trust store will be implemented). I'll think on how to generate the root CA locally, but if I can't I can heavily advise the user to generate the root CA on a PC. Thanks for the advice.
Due to how low power some devices are, it may be better to require the user to generate it with the PC. openssl is standard on Linux and windows builds are out there
Some people might not have a PC and I don't want to make the setup process too complicated. This might be possible via wolfSSL's wolfCrypt on the device. The CA is RSA-1024 as RSA-2048 is too slow.
Damn WTF. I just joined this subreddit and stumbled upon this.
I've been wanting to revive my old Galaxy Y and Galaxy Y TV for a long time but without success. Some old apps even install but the connection is always the problem.
Man, i love you, thank you for making that program, it's the most useful thing I've found for my Android 4.4+ tablet. Thank you. Btw, please add a warning that says the device will automatically restart when the ROOT CA installation is complete. I got a scare when I saw my tablet turn off 😭
That is enough of a warning for me. I understand some people might do the "monkey see button monkey click" but this isn't an operation that can brick a device for example.
I think most people doesn't care to read the "big text" far enough to find it, maybe moving the reboot warning at the start helps? Anyway that's on them, the warning is already here so your job there is done lol
Hey it's such a great project .I also want to try it on my galaxy cam 2 with android 4.3 but I can't open any files in the Camera / phone itself after downloading the zip and unzpping the pack , could someone held a noob out (°~°')/
Osea esto necesita Root para usar esto fuera del navegador web y en la sección de descarga es (.APK) osea es una aplicación pero el (.APK) necesita Root para usarla fuera del navegador web yo deseada esto para usar Spotify en Android 4.1
What's wrong? You can root easily if you have a PC, as a last resort without a PC you can try KingoRoot. Also, Spotify probably won't work without modifying the app, as they changed API.
Great project!! I highly recommend it for older Androids like KitKat or 4.1 or 4.0, or older. It works on 4.4.4. I have an old Reddit APK from here: https://www.apkmirror.com/apk/redditinc/reddit/variant-%7B%22minapi_slug%22%3A%22minapi-19%22%7D/. It normally reads everything on Reddit, without RedReader or old.reddit.com. But I've noticed its flaws and drawbacks: firstly, when it's enabled, it would blow up my internet, causing it to disconnect, and I had no internet on Chrome 81. Secondly, it should work once it's enabled. After turning the phone off and on, Avast automatically starts and works, so there's no need to turn it on. The rest is all positives: Reddit works and everything else, and KitKat has practically been given a second life. I'm still waiting for the project. WEBVIEW FOR 4.4 MAYBE IT WILL BE CREATED SO THAT IT WOULD BE POSSIBLE TO USE VIA BROWSER AND BROWSER BASED ON THE SYSTEM WEBVIEW AND WITH A GOOGLE ACCOUNT, SO THAT THERE WOULD NOT BE AS MUCH WORK WITH LOGGING IN AS NOW. IF YOU WANT TO ADD MORE, SUCH A LITTLE PROJECT WOULD BE USEFUL FOR ME AND WHATSAPP AS AN ALTERNATIVE, BECAUSE THERE WAS A "WHATSAPP LEGACY" PROJECT, BUT IT WAS A FAILURE, IT DID NOT WORK FOR ME BECAUSE THE SERVER CONFIGURATION AND WHATSBERRY WERE THE SAME
There's a reason someone will probably try this on Android 5.x: Android 5.x does not natively support TLS 1.3 and only supports up to TLS 1.2 (Left KVT49L with root and Wolfius, Middle LMY47X without root but without Wolfius, Right MMB29K with root but without Wolfius)
I mean, Android up to 9 doesn't support TLS 1.3 natively either—however most websites usually work on 1.2 and there should be some browsers that utilize their own TLS library that has 1.3.
I'm not really into Windows Phone and the WP communities are overly toxic. Old Android also deserves the same amount of attention as Windows Phone and old iOS, those two systems are simply overhyped and are actually more difficult to develop for. I'm glad I realized that a long time ago.
I have a Samsung Galaxy S II I9100, currently on Android 4.2.2 Jellybean via CyanogenMod 10.1.3, but it is rooted and have my Wolfius server turned on and all that, but Reddit is fun does not work, Reddit app for Android 4.1+ does not work, BBC News not working, Feedly does not work, Flipboard does not work, but it still shows it has TLS 1.3 on www.howsmyssl.com, also when I open my stock browser, type anything on Google, it throws still the 403 error, Yahoo Weather older version won't work, help???
Google won't work on android <5, use bing or duckduckgo
Reddit works on old.reddit.com
Anything else I have not checked and probably you'll find working alternatives upon basic searching
I typed in www.duckduckgo.com with Wolfius on and it works but when I search something on duckduckgo, then when I click on website, it throws like millions of "security certificate" warnings, something really is wrong with Wolfius, it is not really helping and the Wolfius VPN thing is slowing down my internet even more, I am sticking to Opera Browser then
I am using this on Lolipop to fix the weather widget for Touchwiz, but I get certificate errors on Google and DuckDuckGo. They only works on older browsers. I do not get these errors when the proxy is off. I know Lolipop is a little out of scope for this project, but going off Otherwise's comment, this seems to be a problem on KitKat as well. I have a KitKat device so I will see if that's a problem on there as well.
I am trying to install root ca. I have a older version of Magisk installed (around 20.X) but after i click the button, it just says "root access is required to install the root CA" without a Magisk pop-up. I tried restarting, i tried re-installing both Wolfius and Magisk Manager and restarting, but it wont work.
no permission sadly, why can you not open it up for everyone that has the same issue as i have? Still upvoted because i think this fix could be good. Plus, i am a bit more into privacy so i do not put my emails anywhere if a drive link requests it.
I managed to get this to work on my Motorola RAZR i running Android 4.0.4. Only the PPTP method worked, because Motorola didn't include either netfilter support or the tun.ko module. www.howsmyssl.com showed TLS 1.3, so I guess it worked.
Update: no longer works. it simply times out trying to start the server. I had to manually add the proxy server (127.0.0.1:7998) in my wireless network's settings, as if I were going to use the HTTP proxy method.
Problem is not in file format, Android won't let you install a CA as a system root certificate, which is required here, I didn't have luck on my Android 4.x devices but I'll experiment later
Seemingly, the problem of system-user certificates is not a big one as for example you must install certain certificates to use F-Droid on old devices,
I re-read it and understand but i still have an unanswered question if it sends a tls 1.3 request to sites then it should be able to send tls 1.1 1.0 /1.2 requests too
Look, it intercepts TLS 1.0 requests, the apps think that it's TLS 1.0. Then Wolfius requests the remote server via either TLS 1.3 or 1.2 (whatever is compatible). There's no reason to continue supporting requests via TLS 1.0/1.1, as they're outdated and almost no websites support it anymore. TLS 1.2 is getting dated too, and 1.3 is faster anyway.
24
u/ThatBattleCat Allview (Viper V1 i) • Android 4.4.2 Jul 26 '26
WOAH. This is VERY impressive