Teach your device to trust Neko

HTTPS is encrypted. For Neko to show it to you, your device has to trust Neko’s certificate. It takes about a minute.

First: why isn’t the certificate on this page?

Every Neko install makes its own certificate, and its private key never leaves your computer. So there’s nothing to download from this website, and that’s on purpose. Your device gets the certificate straight from your own Neko:

http://neko.local

That address only works on a device that is already sending its traffic through Neko. Do step 1 first.

1 Send the device through Neko

  1. Start Neko on your computer. The proxy listens on port 8899.
  2. Set the device’s proxy to Manual, host 127.0.0.1, port 8899. For an emulator use the host’s address (Android: 10.0.2.2).

Neko listens on your own machine only. Phone-over-Wi-Fi (LAN mode) is still being built, so for now use the same computer, an emulator, or the in-app SDK for phones.

2 Install the certificate

On the device, open http://neko.local in its browser. Or follow the steps for your platform here.

Use Safari. Other iPhone browsers can’t install profiles.

  1. Open http://neko.local/ca.mobileconfig and tap Allow.
  2. Open Settings → Profile Downloaded (or General → VPN & Device Management), then Install.
  3. Then turn on full trust: Settings → General → About → Certificate Trust Settings, and switch Neko on. Without this, HTTPS still fails.

3 Check the fingerprint

On http://neko.local the page shows the certificate’s SHA-256 fingerprint and turns green once your device trusts it. Compare the fingerprint with Settings → Certificate in the Neko app. If they differ, don’t install: you aren’t talking to your own proxy.

Questions

Is it safe?

The private key was made on your computer and stays there. It isn’t in the file you download. Anyone with the key could read your HTTPS traffic, so only install a certificate from a Neko you run yourself, and remove it when you’re done.

What can’t Neko see?

Apps that pin their certificate refuse Neko’s. Neko notices, passes that traffic through untouched, and flags it in the app.

It still says “not trusted”
  • iPhone: did you switch on full trust under Certificate Trust Settings?
  • neko.local doesn’t load: the device isn’t using the proxy. Recheck the proxy address and that you’re on the same network.
  • The device’s date is wrong: turn on automatic date and time.
  • Only one app fails: it likely pins its certificate or ignores user certificates.
How do I remove it?

iPhone: Settings → General → VPN & Device Management → profile → Remove.
Android: Settings → Security → Encryption & credentials → Trusted credentials → User → remove.
macOS: Keychain Access → System → delete the Neko certificate.
Windows: certmgr.msc → Trusted Root Certification Authorities → delete it.
Linux: delete the file you copied, then run update-ca-trust or update-ca-certificates --fresh.