Install the APPLEBEE-ROOT26 root
Until a machine trusts this root, every certificate this CA issues looks broken to it. This page is deliberately readable without logging in, so you can point a fresh machine at it before it has any credentials.
Check the fingerprint before you trust anything.
Every script below verifies the root against the SHA-256 shown here and refuses to install anything else. That check is only as good as the number you compare it to — read it from the server console, not from this page, if you are installing over a network you do not control.
- Subject
- CN=APPLEBEE NETWORKS ROOT CA (EC)
- Expires
- 2046-08-25
b1aa5115d3adbfb821e8ca6a7db14de180640eb4da3586066b13fe76aec1c762
- Subject
- CN=APPLEBEE NETWORKS ROOT CA (RSA)
- Expires
- 2046-08-25
95fb9ab7db52c08b1084fc7756ed30c64dabe4cdc5dcb77847ccd6f7a8cf9d7b
One-liners
Each of these downloads the root, checks its fingerprint against the value compiled into the script, and installs it into the system trust store. They install trust only — no certificate is issued and nothing is enrolled. For a machine that should also get its own auto-renewing certificate, use an enrollment token instead.
Linux
curl -fsSL https://ca.applebee1558.com/trust/install.sh | sudo sh
Handles Debian/Ubuntu, RHEL/Fedora, Alpine and Arch, plus the separate NSS store that Firefox and Chrome keep for themselves. Read it first if you would rather not pipe a script into a root shell: /trust/install.sh.
macOS
curl -fsSL https://ca.applebee1558.com/trust/install-macos.sh | sudo sh
Or download the configuration profile and double-click it — on modern macOS you then approve it in System Settings → Privacy & Security → Profiles. The same file works for iOS and iPadOS, where trust must additionally be enabled under General → About → Certificate Trust Settings.
Windows
irm https://ca.applebee1558.com/trust/install.ps1 | iex
Run it in an elevated PowerShell — it writes to
LocalMachine\Root, which needs administrator rights. For fleets,
see the GPO and Intune notes.
Files
The bundle contains every root above. Installing it once covers both hierarchies, so a machine never has to come back here because something picked the other one.
Other places trust has to be installed
Containers
Each image has its own store; baking the root in at build time beats mounting it at run time.
Dockerfile snippets →Mobile
Android 7+ ignores user-installed roots for app traffic unless the app opts in.
iOS and Android notes →