Shouldn't Android/Firefox work with default rootCA?
Author: owenBeresfordCreated Jul 28, 2026Updated Jul 28, 2026
Environment
two sections:
- dev machine: called "hiss", ubuntu 24, mkcert 1.4.4
- client device: android, stock firefox,
What you did
- read mkcert.org website
- Read, by default, mkcert will use mozilla rootCA
- installed mkcert from your github to hiss
- mkcert -install
- mkcert "$PROD_URL" localhost "$MY_LAN_IP" ::1
- copy files to relevant directory, restart my App
- from hiss, curl -v https://$PROD_URL:3001/
- get much debug, NO SSL ERRORS
- also on hiss in Chrome, open https://$PROD_URL:3001/
- GUI SSL validation reports NO SSL ERRORS
- swap to phone, open firefox
- paste URL,
* "end user details" error message, but looks like rootCA mismatch
What went wrong
Am I confused that the Mozilla rootCA is applied as a default in mkcert, and this will be used in android/ firefox by default? I can't copy the standard text as FF keeps trying to help by redirecting to google. it says in end user level of detail that the cert isn't valid, and I infer the roortCA is mis-matching
Source: FiloSottile/mkcert