1. Click the “Start” menu, type mmc, and select “Run as administrator” to access the Windows Management Console. When prompted with the “User Account Control” window, select “Yes” to allow this program to run.

2. When the Management Console opens, navigate to File > Add/Remove Snap-in.

3. Select “Certificates” in the left side menu, then “Add”. This will open another window.

4. Select “Computer account” and click “Next”. Leave defaulted options on the next screen and click “Finish”.

5. When you return to the “Add or Remove Snap-ins” page, ensure “Certificates (Local Computer)” exists under “Console Root” in the “Selected snap-ins” section, then click “OK”.

6. In the left hand menu of the Management Console, navigate to Certificates (Local Computer) > Trusted Root Certification Authorities > Certificates.

7. Right click on the “Certificates” directory, then navigate to All Tasks > Import.

8. Click “Next” on the first page of the Certificate Import Wizard, then browse to the location where you saved the downloaded certificate and open it. Then click “Next”.

9. On the “Certificate Store” window, ensure that it says “Trusted Root Certificate Authorities” and click “Next”. Then click “Finish” on the final screen.

10. Select “OK” when the import is successful.

11. Verify your server’s unique <your-server-name> Local Root CA certificate is in the “Certificates” folder.

12. You can save the console settings (where we added a snap-in), if desired. Your Root CA will remain imported to the CA certificate store either way, and you will likely use this guide if you need to import a new certificate.

13. If using Firefox, Thunderbird, or Librewolf, complete this final step.

1. Open your iCloud Downloads folder and click on the certificate. It will display a dialog box that says Profile Downloaded. Click “Close”.

2. Head to Settings > General > VPN & Device Management.

3. Under “DOWNLOADED PROFILE”, click your Root CA.

4. Click “Install”.

5. Click “Install” again.

6. Click “Install” for a 3rd time.

7. You should see green text with a check-mark saying “Verified” under the Profile Installed dialog.

8. Tap “Done”.

9. Go to General > About > Certificate Trust Settings and enable your Root CA.

10. Click “Continue”.

This guide applies to Android 13+, GrapheneOS, CalyxOS, and LineageOS.

1. Go to Settings > Security > More security settings > Encryption & credentials > Install a certificate > CA Certificate > Install Anyway, then select your custom-named your-server-name.crt certificate.

2. If using Firefox, you must use Firefox Beta, then complete this final step.

This should work for most Debian-based systems, such as Debian, Ubuntu, Mint, PopOS etc.

1. Open a terminal and run:

   sudo apt update
   sudo apt install -y ca-certificates p11-kit
   

2. Move into the directory where you downloaded your Root CA (usually ~/Downloads), for example:

   cd ~/Downloads
   

3. Add your Root CA to your OS trust store. Be certain to replace your-server-name with your server’s unique hostname:

   sudo mkdir -p /usr/share/ca-certificates/start9
   sudo cp "your-server-name.crt" /usr/share/ca-certificates/start9/
   sudo bash -c "echo 'start9/your-server-name.crt' >> /etc/ca-certificates.conf"
   sudo update-ca-certificates
   

   If successful, you will see the output 1 added.

4. If using Firefox, Thunderbird, or Librewolf, complete this final step.

1. Move into the directory where you downloaded your Root CA (usually ~/Downloads), for example:

   cd ~/Downloads
   

2. Add your Root CA to your OS trust store. Be certain to replace your-server-name with your server’s unique hostname in the second command:

   sudo pacman -S ca-certificates
   sudo cp "your-server-name.crt" /etc/ca-certificates/trust-source/anchors/
   sudo update-ca-trust
   

   Despite no output from the last command, you can test your app right away.

1. Move into the directory where you downloaded your Root CA (usually ~/Downloads), for example:

   cd ~/Downloads
   

2. Add your Root CA to your OS trust store. Be certain to replace your-server-name with your server’s unique hostname in the second command:

   sudo dnf install ca-certificates
   sudo cp "your-server-name.crt" /etc/pki/ca-trust/source/anchors/
   sudo update-ca-trust
   

   There will be no output if the update-ca-trust command completes successfully.

Warning

The regular Firefox app will not work. You must use Firefox Beta.

1. Go to Menu > Settings > About Firefox and tap the Firefox icon 5 times to enable “developer mode”.

2. Go back to Menu > Settings > Secret Settings (at the bottom), and tap “Use third party CA certificates”.

1. In the hamburger menu, click “Settings”. Search for security devices and select “Security Devices…”

2. When the Device Manager dialog window opens, click “Load”.

3. Give the Module Name a title, such as “System CA Trust Module”. For the Module filename, paste in /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so and hit “OK”.

   Tip

   The path to p11-kit-trust.so will be slightly different if your processor’s architecture is not x86_64.

4. Verify that the new module shows up on the left hand side and click “OK” in the bottom right.

5. Restart the app.

No special steps required.