As far as I understand the support of user "trusted credentials" CAs needs to be enabled in the app [security policy](https://developer.android.com/training/articles/security-config.html). The following apps use this approach: - [nextcloud](https://github.com/nextcloud/android/blob/master/src/main/res/xml/network_security_config.xml) - [bitwarden](https://github.com/bitwarden/mobile/blob/master/src/Android/Resources/xml/network_security_config.xml)