Default Horse internal CA

This installs trust for the private certificate authority used by services under on.default.horse and home.arpa on this tailnet. It does not grant trust for anything else.

iOS / iPadOS

Download the profile and open it.
Settings → General → VPN & Device Management, tap the profile, Install.
Settings → General → About → Certificate Trust Settings, enable full trust for “Default Horse CA”. This step is required — installing the profile alone isn't enough.

macOS

Either works:

Download the profile, open it, then approve it in System Settings → Privacy & Security → Profiles.

Or, with step installed:

step ca bootstrap \
  --ca-url https://100.64.0.1:8443 \
  --fingerprint 8da5e76689f38d91ee850f841b52f1bf8a5d74f1a250ce7c2d9bf5ccddf088f9 \
  --install

Windows

Either works:

Download the certificate, double-click it, Install Certificate… → Local Machine (needs admin) → Place all certificates in the following store → browse to Trusted Root Certification Authorities → Next → Finish.
Or, from an admin PowerShell/cmd prompt, after downloading the certificate above:
```
certutil -addstore -f "Root" default-horse-root-ca.crt
```
Or, with step installed, same command as macOS/Linux below — --install uses certutil under the hood on Windows too.

Android

Download the certificate.
Settings → Security & privacy → More security & privacy → Encryption & credentials → Install a certificate → CA certificate (exact wording and path vary by manufacturer/Android version), then select the downloaded file and confirm the warning.

Note: Android doesn't trust user-installed CAs for most apps by default on Android 7+ (only for apps that explicitly opt in via their network security config) — this will work for browsers like Chrome/Firefox, but individual apps may still reject it.

Linux / other (step CLI)

Fetches the root over TLS, verifies it against the fingerprint, and installs it into your system trust store in one step:

step ca bootstrap \
  --ca-url https://100.64.0.1:8443 \
  --fingerprint 8da5e76689f38d91ee850f841b52f1bf8a5d74f1a250ce7c2d9bf5ccddf088f9 \
  --install