Install the root certificate on Android
Android 11 and later don’t let an app install a CA certificate on its own; that’s an Android platform restriction, not a limitation specific to HTTPGlass. Instead, HTTPGlass writes the certificate to a file and you install it by hand, once, in Android Settings.
Before you start: set a screen lock
Section titled “Before you start: set a screen lock”Android requires a PIN, pattern or password on the device before it allows installing a CA certificate at all. If you don’t have one set, add it first in Settings › Security.
Step 1: save the certificate
Section titled “Step 1: save the certificate”In HTTPGlass, go to the certificate screen and save it. It writes HTTPGlass-Root-CA.crt
to your Downloads folder.
Step 2: install it in Android Settings
Section titled “Step 2: install it in Android Settings”The exact wording varies by manufacturer. Google’s Add & remove certificates help page covers Pixel phones:
Stock Android / Pixel:
Settings › Security & privacy › More security & privacy › Encryption & credentials › Install a
certificate › CA certificate › Install anyway › enter your PIN › pick
HTTPGlass-Root-CA.crt from Downloads.
Samsung: Settings › Security and privacy › More security settings › Install from device storage › CA certificate › pick the file.
Xiaomi / HyperOS: Settings › Passwords & security › Privacy › Encryption & credentials — on some versions this is under Additional settings instead. Install a certificate › CA certificate › pick the file.
Android warns that a CA certificate lets its holder monitor network activity. That’s accurate: it’s what makes decryption possible, and it’s why the step needs your explicit confirmation rather than happening automatically.
Step 3: confirm
Section titled “Step 3: confirm”Back in HTTPGlass, the certificate screen turns green once Android reports the certificate as installed.
Which apps this actually unlocks
Section titled “Which apps this actually unlocks”This is the part worth understanding before you rely on it: only browsers (Chrome, Firefox,
and so on) and your own debug builds — ones with a network_security_config.xml that trusts
user-installed certificates — will show decrypted HTTPS through this certificate. Apps built
for API level 24 and later ignore user-installed CAs by default, by Android design
(Android Developers Blog), regardless
of whether the certificate is installed and trusted. For those apps, HTTPGlass still shows the
connection — host, size and timing — just not the decrypted body, and it tells you which is
which as you capture. See Why doesn’t Android decrypt this
app? for the full explanation and the debug-build fix.
Removing the certificate
Section titled “Removing the certificate”Go to the same Settings screen as above, then User credentials (or Trusted credentials › User on some versions), find HTTPGlass’s certificate, and remove it.