# "Network may be monitored" on Android: meaning and removal

> Android shows Network may be monitored when an added CA certificate could intercept HTTPS. How to find who installed it and how to remove it.

Source: https://ssl.sh/errors/android-network-may-be-monitored/
Last updated: 2026-11-10

**"Network may be monitored" means a certificate authority has been added to your Android device's trusted credentials, and whoever controls that CA could decrypt HTTPS traffic from apps that trust it.** It is a notice, not an error, and does not prove that anyone is watching.

## Where the text appears

The wording depends on the Android version:

| Android version | Where you see it |
|---|---|
| 4.4 to 6.0 | Notification titled "Network may be monitored", with "By an unknown third party" |
| 7.0 and later | Notification titled "Certificate authority installed" (or "authorities"), with "By an unknown third party", "By your work profile admin" or "By example.com" |
| 7.0 and later | Quick Settings footer "Network may be monitored"; Settings dialog with the same title |

The Settings dialog explains: "A third party is capable of monitoring your network activity, including emails, apps, and secure websites. A trusted credential installed on your device is making this possible." Manufacturers often reword these strings in their own Android skins.

## How much risk it creates

The risk depends on two things: who holds the private key of the added CA, and which apps trust it. Since Android 7.0, [apps that target API level 24 or later trust only the system CAs](https://ssl.sh/errors/android-app-user-ca-not-trusted/) unless their developers opt in, so most banking and shopping apps ignore a user-added CA. Browsers and apps built for older API levels may still trust it. Interception also needs something in the traffic path, such as a VPN app, a proxy setting or a network device, that uses the CA. A CA you installed for one debugging session on a test phone is a small risk; an unexplained CA on your everyday phone is not.

## Common causes, most frequent first

### 1. You installed a CA for debugging or a tool

Developers install the root of Charles, Fiddler, mitmproxy, Proxyman or a packet-capture app to inspect HTTPS. The warning stays until the CA is removed.

### 2. A VPN, ad-blocker, parental-control or antivirus app

Apps that filter HTTPS content need a CA to do it and ask the user to install one during setup. Desktop security suites do the same, see [antivirus HTTPS scanning](https://ssl.sh/errors/antivirus-https-scanning-ssl-error/). Check recently installed apps and their setup steps.

### 3. Your employer or school manages the device

With a work profile or a fully managed device, the notification names the work profile admin or the organization's domain. Corporate TLS inspection uses such a CA, see [corporate SSL inspection](https://ssl.sh/errors/corporate-ssl-inspection/). Ask IT before removing anything; the policy will usually reinstall it.

### 4. Wi-Fi or VPN setup that imported a CA into the general store

Some enterprise Wi-Fi or VPN instructions have users install a CA certificate. If it went into the general CA store rather than being used only for that connection, it triggers the warning.

### 5. An unknown or malicious certificate

If you cannot explain the certificate, treat it as a risk: stalkerware and malicious profiles use the same mechanism.

## Confirm which certificate is responsible

1. Tap the notification or the Quick Settings footer and choose to check the certificate. The dialog lists the CA names.
2. Or open Settings > Security (or Security & privacy) > More security settings > Encryption & credentials > Trusted credentials and select the **User** tab. Every entry there is user-added.
3. Tap an entry to see its issuer, validity and fingerprint. Names such as "Charles Proxy", "mitmproxy" or an app vendor identify the source.

## How to fix it

Remove the CA and the app that installed it; on a managed device, ask IT instead.

**Remove a CA you no longer need:** in Trusted credentials > User, tap the certificate and choose Uninstall. Pixel phones also offer Encryption & credentials > User credentials to remove specific credentials, or Clear credentials to remove all user certificates.

**Remove the app that installs it:** uninstall the VPN, filter or capture app first, otherwise it may add the CA again.

**Managed devices:** leave the CA in place if your organization requires it, or ask IT to remove the work profile.

**Developers:** keep debugging CAs on test devices only. In your app, trust them only in debug builds:

```xml
<network-security-config>
    <debug-overrides>
        <trust-anchors>
            <certificates src="user" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>
```

Android's documentation notes that `debug-overrides` applies only when `android:debuggable` is true, so release builds are unaffected.

## How to verify the fix

1. The Trusted credentials > User tab is empty, or contains only CAs you have decided to keep.
2. The notification and the Quick Settings footer no longer appear after a restart.
3. Open a site you know in Chrome, tap the icon left of the address and check that the certificate is issued by a public CA rather than a proxy or filter product; compare with the [SSL checker](https://ssl.sh/tools/ssl-checker/).