October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
Mountain View desk3 min

Make Your App Certificate-Transparency-Ready for Android 17

Android 17 enables certificate transparency by default for apps targeting API 37 or higher. Audit trust anchors and Network Security Configuration, then test real app flows on an Android 17 emulator or device.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For apps targeting Android 17’s API level 37 or higher, certificate transparency (CT) is enabled by default—but that does not mean every app connection is automatically checked. Network Security Configuration and the trust anchors used for a connection affect whether CT verification applies. Audit those settings, then test the app’s real network flows on Android 17.

What changes when your app targets Android 17?

Android 17 uses API level 37. The platform enables CT by default for apps targeting API 37 or higher; on Android 16, CT was available but apps had to opt in. The target-SDK setting matters, so distinguish changes gated on targeting Android 17 from changes that apply to apps running on Android 17 regardless of target. Google maintains separate behavior-change documentation for those scopes.

As an Amazon Associate I earn from qualifying purchases.

CT checks whether publicly trusted certificates have been logged in public certificate-transparency logs. It is not a blanket guarantee that every connection made by every app is subject to verification: the app’s trust configuration and the certificate chain in use matter.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Audit trust anchors and Network Security Configuration

Start by mapping the app’s TLS traffic and the trust model behind it. Review built-in networking code, third-party TLS libraries, certificate pinning, custom trust managers, debug-only trust anchors, user-installed roots, and private or enterprise certificate authorities. Validate third-party stacks separately; Android’s documented Network Security Configuration behavior is not a universal migration recipe for every TLS implementation.

#1 Best Overall
Sale
Samsung Galaxy A17 5G Smart Phone 128GB US 1 Yr Manufacturer Warranty Black
  • YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
  • LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
  • MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
  • NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
  • BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.

In the app’s Network Security Configuration XML, inspect each <domain-config> and its inherited <base-config>. Android documents an optional <certificateTransparency enabled="true"/> element. Its evaluation order considers explicit CT enablement first, then user or inline trust anchors, then inherited configuration.

Android’s documentation says CT verification is disabled by default for connections using an app’s own certificate or the user certificate store, since those certificates are unlikely to be publicly logged. User or inline trust anchors disable CT verification unless it is explicitly enabled in the applicable domain configuration. Do not assume that every custom certificate fails—or that every connection is checked. Determine which configuration and trust anchors apply to each connection before changing policy.

Rank #2
Tracfone Motorola Moto G 2025, 64GB, Saphire Blue (Locked to
  • Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
  • DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
  • CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
  • PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
  • BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.

Test the app’s real flows on Android 17

Google’s guidance is to install the app on an Android 17 device or emulator and exercise its flows. The Android Emulator, included with Android Studio, simulates devices and API levels; a physical phone is optional for many test cases. Use a physical device when a flow depends on hardware or vendor-specific behavior, or when you need real-hardware validation.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Test option Useful for Trade-off
Android Emulator Trying different virtual device configurations and API levels; many app-flow checks. Simulated hardware may not reproduce every physical-device or vendor-specific behavior.
Physical Android 17 device Validating real hardware and device-specific behavior. Requires access to suitable hardware and does not replace testing across other device configurations.

For both options, work through the same app scenarios and record failures. Include sign-in, API calls, update checks, embedded web content, and any enterprise or private-certificate paths the app supports. When a connection fails, investigate whether the cause is certificate validation or an unrelated network error; the cited Android guidance recommends exercising app flows but does not specify a dedicated CT test harness.

Rank #3
Sale
Samsung Galaxy A17 5G Smart Phone 128GB, US 1 Yr Manufacturer Warranty Blue
  • YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
  • LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
  • MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
  • NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
  • BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
  1. Confirm whether the release will target API 37 or higher.
  2. Inventory TLS clients, endpoints, pinning, custom trust managers, Network Security Configuration, and any private or user-installed trust anchors.
  3. Install the app on an Android 17 API 37 emulator or device and exercise the relevant flows.
  4. Correct the app’s trust or networking configuration where needed, then rerun the same scenarios.
  5. Review Android 17’s complete behavior-change documentation for other changes that affect the app.

Check other Android 17 behavior changes

Targeting API 37 can bring app-specific changes beyond CT. Check the official behavior-change lists for the target-SDK and runtime scopes that apply to your app. In particular, assess:

  • Local-network access: Android 17 introduces the ACCESS_LOCAL_NETWORK runtime permission. Where appropriate, system-mediated privacy-preserving pickers may avoid a broad permission prompt.
  • Native dynamic loading: Native files loaded with System.load() must be read-only; otherwise, the system can throw UnsatisfiedLinkError.
  • Large screens: Review the changes to resizability behavior against the app’s supported layouts.
  • Background audio: Check the applicable foreground-service and while-in-use requirements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

App testing is not CTS certification

The Compatibility Test Suite (CTS) is for checking Android device implementations, not for certifying an ordinary app or substituting for testing its TLS behavior. AOSP describes CTS as a free suite with automated tests and manual tests through CTS Verifier. App-flow testing, by contrast, checks how your own product behaves on Android 17. A CTS device-performance requirement is not evidence about CT behavior or the likelihood that apps will fail.

Quick Recap

Best Value
Tracfone Moto g Play 2024 Prepaid Phone with a 1-Yr Plan Included
  • Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
  • ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
  • CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
  • PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
  • 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Rank #4
Sale
Samsung Galaxy S26 Ultra, Unlocked Android Smartphone, 512GB, Black
  • PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
  • TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
  • NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
  • MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
  • HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.