Android — installing the APPLEBEE-ROOT26 root
============================================================

Verify the fingerprint on the device before confirming:

  ECDSA (P-256)
    b1aa5115d3adbfb821e8ca6a7db14de180640eb4da3586066b13fe76aec1c762
  RSA (legacy compatibility)
    95fb9ab7db52c08b1084fc7756ed30c64dabe4cdc5dcb77847ccd6f7a8cf9d7b

Android 11 and later
  1. Transfer applebee-root26-roots.pem to the device (email, Drive, USB).
  2. Settings → Security → Encryption & credentials → Install a certificate
     → CA certificate.
  3. Accept the "your network may be monitored" warning — that warning is
     Android telling you a non-public CA is being trusted, which is exactly
     what you are doing.
  4. Confirm under Trusted credentials → User.

Important limitation
  Since Android 7, apps do not trust user-installed CAs by default. A browser
  will work; most apps will not. For an app you control, add a network
  security config:

    <!-- res/xml/network_security_config.xml -->
    <network-security-config>
      <base-config>
        <trust-anchors>
          <certificates src="system" />
          <certificates src="user" />
        </trust-anchors>
      </base-config>
    </network-security-config>

  and reference it from the manifest:

    <application android:networkSecurityConfig="@xml/network_security_config">

  For apps you do not control, there is no supported route on an unrooted
  device. Use a publicly-trusted certificate for those hostnames instead.

iOS / iPadOS
  1. Install applebee-root26-roots.mobileconfig (AirDrop, email, or a download).
  2. Settings → General → VPN & Device Management → install the profile.
  3. Then, separately: Settings → General → About → Certificate Trust
     Settings → enable full trust for the root. Step 3 is required; without
     it the certificate is installed but not trusted.