Access from another device

[pyzenberg]

Hi Aleph,
Thanks for sharing your great port!
The proxy runs just fine on my laptop, but when i want to use it from my phone (phone and laptop both are on the same LAN) then i'm getting this error on V2RayNG:

Fail to detect internet connection: tls: failed to verify certificate: x509: certificate signed by unknown authority.

I think I should add the generated CA on my phone but I couldn't find any way to do it yet.

Regards

[therealaleph]

Hey @pyzenberg — thanks! Yes, your diagnosis is right: the phone needs to trust mhrv-rs's CA or the MITM layer can't rewrite TLS for you. Here's the full walkthrough, plus a note about V2RayNG specifically.

1. Find the CA on your laptop

The file is ca.crt in the mhrv-rs data directory:

OS	Path
macOS	~/Library/Application Support/mhrv-rs/ca/ca.crt
Linux	~/.config/mhrv-rs/ca/ca.crt
Windows	%APPDATA%\mhrv-rs\ca\ca.crt

2. Transfer it to your phone

AirDrop / Nearby Share / email to yourself / scp — whatever. You just need the file on your phone's storage.

3. Install it as a user CA

Android:
Settings → Security & privacy → More security settings → Encryption & credentials → Install a certificate → CA certificate → accept the warning → pick ca.crt.

(Path varies by vendor — on some Samsungs it's Settings → Biometrics and security → Other security settings → Install from device storage → CA certificate.)

iOS:
Mail the file to yourself, tap it in Mail, Settings → General → VPN & Device Management → install the profile. Then Settings → General → About → Certificate Trust Settings → toggle Enable Full Trust for it.

4. Set the phone's HTTP proxy to your laptop

Android WiFi settings: long-press your WiFi → Modify → Advanced → Proxy = Manual → Hostname = laptop's LAN IP, Port = whatever mhrv-rs is listening on (default 8080).

iOS WiFi settings: tap the (i) next to your WiFi → Configure Proxy → Manual → same fields.

5. About V2RayNG specifically

This is where it gets complicated. On Android 7+, user-installed CAs are NOT trusted by most apps by default — including V2RayNG's internal connectivity check. That's an Android security model thing, not a V2RayNG bug. Two options:

• Easier: don't use V2RayNG for this at all. Just set the HTTP proxy directly in Android WiFi settings (step 4). Chrome / most browsers DO trust user CAs, so browser traffic will work straight away. Many other apps won't — that's the Android 7+ trade-off.
• V2RayNG route: in your outbound's streamSettings → tlsSettings (or in the JSON config), set "allowInsecure": true. This disables TLS verification on V2RayNG's side, so it'll accept mhrv-rs's leaf cert. That's only safe because the mhrv-rs relay already wraps your traffic in its own auth_key layer — but I'd still only do it if you actually need V2RayNG chained through mhrv-rs (most people don't).

The underlying issue — why this is clunky

I can't do better than "install the CA manually" today because Android requires user-installed CAs for Chrome to trust a MITM proxy, and no app other than Chrome honors them without an explicit networkSecurityConfig. A native Android app would solve this, but that's a bigger project. For now, direct HTTP proxy + Chrome on the phone is the cleanest LAN sharing path.

Let me know which route you pick / where you get stuck and I'll debug further.