android Rejecting User-Installed CAs to Defeat Proxy Interception Android trusts user-installed certificates by default, which is exactly what lets a proxy CA read your TLS traffic. Photo Cleaner's network security config opts out of that default entirely.
traefik The TLS Handshake Nobody at Home Sees: Full vs Full-Strict Behind Cloudflare Traefik on vmi2633427 issues no certificates and holds no ACME credentials — the browser's cert and the origin's cert are two entirely different documents, and closing the gap between them is one flag in Cloudflare's dashboard.
