Trust the Acehoss Root CA

Some Acehoss services use certificates from our own certificate authority instead of a public one. Install the root certificate below and your device will trust them without warnings. This is optional: the public services (chat, Jellyfin, Home Assistant, Matrix and the rest) use public certificates and work without it.

Check the fingerprint first

A certificate authority is only as trustworthy as the copy you install. Before you trust the file, compare its SHA-256 fingerprint with this one. Every installer shows it, usually with colons or spaces between the pairs.

6B:09:D1:A2:19:96:F7:0D:FB:1A:CE:1E:B1:A4:66:A0:E7:B7:41:2E:02:7B:CF:EC:E2:2F:EF:E0:79:01:62:33

The same fingerprint is published in DNS, so you can check it from a different path than this page: dig TXT _fingerprint.trust.acehoss.net. If the fingerprint your device shows is different from both, stop and tell Aaron.

Download

Apple profile — acehoss-root-ca.mobileconfigiPhone, iPad, Mac. One tap, then approve it in Settings. Certificate (DER) — acehoss-root-ca.cerWindows and Android open this directly. Certificate (PEM) — acehoss-root-ca.crtLinux, servers, command-line tools.

iPhone and iPad

Tap the Apple profile link above in Safari. iOS says Profile Downloaded.
Open Settings. Near the top tap Profile Downloaded, then Install. Enter your passcode and confirm.
Go to Settings › General › About › Certificate Trust Settings and turn on Acehoss Root CA. iOS does not trust a root until you do this step.

Mac

Download the Apple profile and double-click it in Finder.
Open System Settings › General › Device Management (older macOS: Privacy & Security › Profiles), select Acehoss Root CA and click Install.

Prefer the Terminal? Download the PEM file and run:

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain acehoss-root-ca.crt

Windows

Download the DER certificate and double-click it.
Click Install Certificate…, choose Local Machine, then Place all certificates in the following store and pick Trusted Root Certification Authorities.
Confirm the thumbprint Windows shows against the fingerprint above (Windows shows it without separators), then finish.

Or, in an administrator PowerShell:

certutil -addstore -f Root acehoss-root-ca.cer

Android

Download the DER certificate.
Open Settings › Security & privacy › More security settings › Encryption & credentials › Install a certificate › CA certificate (the exact path varies by phone; search Settings for “CA certificate”).
Accept the warning and pick the downloaded file.

On Android, only the browser and apps that choose to accept user-installed certificates will trust it. Most apps will not. That is why the services you use through an app keep public certificates and need nothing from you.

Linux

Debian and Ubuntu:

sudo cp acehoss-root-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Fedora and RHEL:

sudo cp acehoss-root-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Firefox keeps its own store: Settings › Privacy & Security › Certificates › View Certificates › Authorities › Import, and tick Trust this CA to identify websites.

What this does, and does not do

It lets your device verify certificates issued by Acehoss for names under acehoss.net and hizlabs.io. The certificate authority is restricted to those two domains and cannot vouch for any other website, even if it were misused.
It does not install software, does not give anyone access to your device, and does not change how other websites are checked.
You can remove it at any time: delete the profile on Apple devices, or remove Acehoss Root CA from the trusted roots on Windows, Android or Linux.

Valid until October 2041. If it is ever replaced, this page will carry the new fingerprint.