[TOFU] Start with the Android trust store
For devices with supplicant AIDL v2 and up, start the TOFU process
with the default Android trust store, to enable networks that use
a globally trusted CA and do not include it in the TLS handshake.
This will allow to use a Root CA validation of the server cert
instead of using cert pinning.
If a server is using a Root CA that is in the Android trust store,
update the configuration of that connection to use the system
certificates. This will allow continuous service without
interruptions even if the server changes a Root CA provider.
Bug: 271921032
Test: Connect successfully and securely to WPA-Enterprise networks:
* Globally trusted Root CA
* Private Root CA with intermediates
* Partial / leaf only chain
Change-Id: Ib5d870fce696ce8f051e6b7acd0329e1eb7255f9
5 files changed