CertBridge by 许小墨 (Eikeitsu) puts extra CA certificates into Android's system trust store, so apps trust the certificates of HTTPS inspection tools like Reqable and ProxyPin, or any PEM you add. It works on Magisk, KernelSU and APatch and never rewrites the system partition.
How it works
- At each boot it reads the current system and Conscrypt APEX trust stores (no saved copy), merges in the certificates you've enabled, and bind-mounts the combined set over the trust-store paths.
- If copying or validation fails, it skips the injection and the stock trust store stays as it was.
- On Android 14 and newer it binds the main Conscrypt APEX store and, by default, skips the old system path.
- Two mount modes: Compatible (default, merge and bind, no meta-module needed) and Magic (overlay under
system/; fine on Magisk, may need the right mount setup on KernelSU).
WebUI and extras
- A WebUI with home, certificates, logs, hiding and settings pages; it follows the system language (Chinese or English).
- Hot mount: add user or SD-card certificates temporarily, until the next reboot.
- Optional hiding helpers (off by default): KernelSU kernel umount, SuSFS or NoHello, and an opt-in Zygisk filter that hides the module's mounts from chosen apps.
- A command line tool,
cb, for status, settings and certificate tasks.
Installation
- Download
CertBridge_…_arm64.zipfor most phones. There are alsoarm32,x86andx64builds, and alitezip without OpenSSL. - Flash it and, within about 20 seconds, press Volume Up for the recommended defaults or Volume Down to choose settings yourself.
- Reboot, then open the WebUI or run
cb status --live.
The online update follows the arm64 full zip. Uninstalling unmounts the temporary certificates and clears the hiding helpers. MIT licensed; documentation at eikeitsu.github.io/CertBridge.