Trusting the Fluxzy root certificate is the single biggest friction point when onboarding a new device to the proxy. Rather than emailing PEM files or asking testers to scp them across machines, you can publish the certificate over a regular HTTP request. The mountCertificateAuthorityAction short circuits the request pipeline and returns the CA, ready to be installed straight from the device that needs it.
Pick mountCertificateAuthorityAction when you need to hand the Fluxzy root certificate to a device or user without giving them shell access to the proxy host. Fluxzy replies with the certificate body directly, so a phone, a tablet, or a lab VM can fetch it through the proxy connection.
Common situations:
http://fluxzy.ca/ or http://ca.local/.Pair it with a hostFilter so the rule only triggers on the special hostname you reserve for certificate downloads.
Reserve a clear, memorable hostname for the download. A device pointed at the proxy can browse to that URL and install the certificate in two taps.
rules:
- filter:
typeKind: HostFilter
pattern: fluxzy.ca
actions:
- typeKind: MountCertificateAuthorityAction
Before a device trusts Fluxzy, HTTPS interception will fail. Restrict the action to plain HTTP so the certificate can be retrieved during initial enrollment.
rules:
- filter:
typeKind: FilterCollection
operation: And
children:
- typeKind: HostFilter
pattern: ca.local
- typeKind: IsSecureFilter
inverted: true
actions:
- typeKind: MountCertificateAuthorityAction
Reply with the default root certificate used by fluxzy
Evaluation scope defines the timing where this filter will be applied.
dnsSolveDone This scope occurs the moment fluxzy ends solving the DNS of the remote host
mountCertificateAuthorityAction
This action has no specific characteristic
The following examples apply this action to any exchanges
Reply with the default root certificate used by fluxzy.
rules:
- filter:
typeKind: AnyFilter
actions:
- typeKind: MountCertificateAuthorityAction
View definition of MountCertificateAuthorityAction for .NET integration.
The following actions are related to this action:
Yes. The action only delivers the certificate file. The user or the device management system must explicitly add it to the trust store, which on iOS also requires enabling full trust under Settings, General, About, Certificate Trust Settings.
Fluxzy serves the certificate in a format browsers and mobile installers can consume directly. If you need a specific format, regenerate the CA with the Fluxzy CLI and host it on your own static server using serveDirectoryAction.
No. Once devices are enrolled, remove or scope down the rule so the CA endpoint is not reachable by anything else passing through the proxy.