Trust wayden CA (ubuntu-4gb-hel1-1)

Install this certificate on a device that uses hz as its Tailscale exit node. wayden inspects HTTPS through that exit node, and sites fail with certificate errors until the device trusts this CA.

SHA-256 fingerprint
8F:35:32:7D:ED:53:7D:92:0A:A7:AF:FD:46:35:6B:E2:4D:6A:A5:C9:30:3C:7A:B9:6B:5A:02:77:56:BF:7E:02
Valid until Oct 15 17:54:59 2036 GMT Download wayden-ca.crt

Android

  1. Tap Download above. Android only saves the file: it can't install a CA from the browser.
  2. Open Settings → Security & privacy → More security settings → Encryption & credentials → Install a certificate → CA certificate. On some phones it's Settings → Security → Install from storage; search Settings for “CA certificate”.
  3. Tap Install anyway, unlock, and pick wayden-ca.crt from Downloads.
  4. Check it under Trusted credentials → User; the fingerprint should match the one above.

Chrome and most browsers use it at once. Many other apps only trust the CAs built into Android: if one of them breaks through the exit node, its host goes in wayden's mitm.bypass.

iPhone / iPad

  1. Open this page in Safari and tap Download, then Allow.
  2. Settings → Profile Downloaded → Install.
  3. Settings → General → About → Certificate Trust Settings: turn on full trust for wayden CA (ubuntu-4gb-hel1-1). Without this step it's installed but not trusted.

Only trust this on your own devices: a device that trusts this CA lets hz read its HTTPS traffic through the exit node, which is what the filtering needs.