Not working on MIUI 12, Android 10

[fiso64]

I am trying to install a certificate system-wide. The certificate is from my server running caddy, and I have confirmed it works when installed on any windows or linux device (firefox no longer gives any warnings).

After installing the same cert via the system dialog on my phone, I installed the module and rebooted. However, Firefox android still tells me the connection is insecure.

I have checked /system/etc/security/cacerts and the certificate in question does not appear there.

Logs:
magisk_log_2025-11-08T16_27_20.log

System:

MIUI Global 12.0.2
Android 10 QKQ1.190825.002
Xiaomi Mi 9T Pro

Might be same as #22.

[Thomasjbeavan]

Thanks for the detailed breakdown — it sounds like you're doing all the right things, but Android's certificate handling (especially with Firefox) can be tricky. Here's what's likely going on and how you might resolve it:

---

🔍 Why Firefox on Android Ignores System Certificates

Firefox for Android does not use the Android system certificate store by default. Instead, it maintains its own certificate store, which is separate from the system's /system/etc/security/cacerts directory. This is different from how Firefox behaves on desktop platforms.

---

✅ What You Can Do

Here are your options to get Firefox on Android to trust your Caddy server's certificate:

1. Manually Add the Certificate to Firefox
   Firefox for Android allows importing user certificates:

• Open Firefox.
• Go to Settings → Privacy & Security → Certificates.
• Look for an option like Import Certificate or View Certificates.
• Import your .crt file manually.

⚠️ This only works for user certificates, not root CAs. Firefox may still not trust a self-signed root CA unless explicitly configured.

2. Use a Firefox Nightly Build with about:config
   If you're comfortable with advanced settings:

• Install Firefox Nightly from the Play Store.
• Go to about:config.
• Set security.enterprise_roots.enabled to true.

This setting tells Firefox to trust Android's system certificate store, just like on desktop. Once enabled, your system-installed certificate should be recognized.

3. Use Let's Encrypt or a Public CA
   If possible, consider using a publicly trusted CA like Let's Encrypt with your Caddy server. This avoids the need to manage certificates manually on each device.

---

🛠️ Why Your Cert Didn't Appear in /system/etc/security/cacerts

That directory is read-only on most Android devices unless rooted. Even with root access:

• Certificates must be placed there with the correct filename (hash).0 format.
• Permissions and SELinux contexts must be correct.
• A reboot is required after placing the cert.

If you're using a Magisk module to install the cert, ensure:

• The module is correctly placing the cert in the right format.
• The cert is a PEM-encoded X.509 certificate.
• The filename matches the OpenSSL hash of the subject name.

---

Would you like help verifying the correct hash filename for your certificate or checking if your Magisk module is working as expected?