certificate problem

[arya3146]

os:linux mint

isp:irancell

browser firefox:
firefox proxy = socks5
result = youtube.com is most likely a safe site, but a secure connection could not be established. This issue is caused by MasterHttpRelayVPN, which is either software on your computer or your network.
error=Error code: MOZILLA_PKIX_ERROR_MITM_DETECTED

mhrv-rs v1.9.18:
mode = mitm
advanced settings = default
mhrv log = sorry i cant attach the log file.
here is it:

2026-04-25T23:59:19.805731883Z [ui] installing CA...
2026-04-25T23:59:19.806327Z INFO Loaded MITM CA from /home/alireza/.config/mhrv-rs/ca/ca.crt
2026-04-25T23:59:19.806355Z INFO Installing CA certificate on linux...
2026-04-25T23:59:19.806370Z INFO Detected Linux distro family: debian
2026-04-25T23:59:19.806415Z WARN direct install failed — retrying with sudo.
2026-04-25T23:59:21.110114Z INFO CA installed via sudo.
2026-04-25T23:59:21.110579637Z [ui] CA install ok
2026-04-25T23:59:24.500845954Z [ui] starting proxy...
2026-04-25T23:59:24.501599Z INFO Loaded MITM CA from /home/alireza/.config/mhrv-rs/ca/ca.crt
2026-04-25T23:59:24.501678913Z [ui] listening HTTP 127.0.0.1:8085 SOCKS5 127.0.0.1:8086
2026-04-25T23:59:24.501828Z WARN Listening HTTP on 127.0.0.1:8085 — set your browser HTTP proxy to this address.
2026-04-25T23:59:24.501841Z WARN Listening SOCKS5 on 127.0.0.1:8086 — xray / Telegram / app-level SOCKS5 clients use this.
2026-04-25T23:59:25.281725Z INFO h2 connection established to relay edge
2026-04-25T23:59:30.505472Z INFO SOCKS5 CONNECT -> www.google.com:443
2026-04-25T23:59:30.505534Z INFO dispatch www.google.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.505544Z INFO SNI-rewrite tunnel -> www.google.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:30.541556Z INFO HTTP GET http://detectportal.firefox.com/canonical.html
2026-04-25T23:59:30.561953Z INFO SOCKS5 CONNECT -> antpeak.com:443
2026-04-25T23:59:30.562831Z INFO dispatch antpeak.com:443 -> MITM + Apps Script relay (TLS detected)
2026-04-25T23:59:30.562870Z INFO MITM TLS -> antpeak.com:443 (socks_host=antpeak.com, sni=antpeak.com)
2026-04-25T23:59:30.575469Z INFO SOCKS5 CONNECT -> s3-oregon-1.s3-us-west-2.amazonaws.com:443
2026-04-25T23:59:30.576503Z INFO dispatch s3-oregon-1.s3-us-west-2.amazonaws.com:443 -> MITM + Apps Script relay (TLS detected)
2026-04-25T23:59:30.576547Z INFO MITM TLS -> s3-oregon-1.s3-us-west-2.amazonaws.com:443 (socks_host=s3-oregon-1.s3-us-west-2.amazonaws.com, sni=s3-oregon-1.s3-us-west-2.amazonaws.com)
2026-04-25T23:59:30.586933Z INFO SOCKS5 CONNECT -> proigor.com:443
2026-04-25T23:59:30.587541Z INFO dispatch proigor.com:443 -> MITM + Apps Script relay (TLS detected)
2026-04-25T23:59:30.587588Z INFO MITM TLS -> proigor.com:443 (socks_host=proigor.com, sni=proigor.com)
2026-04-25T23:59:30.598372Z INFO SOCKS5 CONNECT -> zorvian.com:443
2026-04-25T23:59:30.599057Z INFO dispatch zorvian.com:443 -> MITM + Apps Script relay (TLS detected)
2026-04-25T23:59:30.599089Z INFO MITM TLS -> zorvian.com:443 (socks_host=zorvian.com, sni=zorvian.com)
2026-04-25T23:59:30.606283Z INFO SOCKS5 CONNECT -> s3-oregon-1.s3-us-west-2.amazonaws.com:443
2026-04-25T23:59:30.606967Z INFO dispatch s3-oregon-1.s3-us-west-2.amazonaws.com:443 -> MITM + Apps Script relay (TLS detected)
2026-04-25T23:59:30.607010Z INFO MITM TLS -> s3-oregon-1.s3-us-west-2.amazonaws.com:443 (socks_host=s3-oregon-1.s3-us-west-2.amazonaws.com, sni=s3-oregon-1.s3-us-west-2.amazonaws.com)
2026-04-25T23:59:30.614799Z INFO SOCKS5 CONNECT -> proigor.com:443
2026-04-25T23:59:30.615807Z INFO dispatch proigor.com:443 -> MITM + Apps Script relay (TLS detected)
2026-04-25T23:59:30.615855Z INFO MITM TLS -> proigor.com:443 (socks_host=proigor.com, sni=proigor.com)
2026-04-25T23:59:30.632442Z INFO SOCKS5 CONNECT -> www.youtube.com:443
2026-04-25T23:59:30.632492Z INFO dispatch www.youtube.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.632500Z INFO SNI-rewrite tunnel -> www.youtube.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:30.712015Z INFO SOCKS5 CONNECT -> 1.1.1.1:443
2026-04-25T23:59:30.713401Z INFO dispatch 1.1.1.1:443 -> MITM + Apps Script relay (TLS detected)
2026-04-25T23:59:30.713451Z INFO MITM TLS -> 1.1.1.1:443 (socks_host=1.1.1.1, sni=)
2026-04-25T23:59:30.743856Z INFO SOCKS5 CONNECT -> www.google-analytics.com:443
2026-04-25T23:59:30.743929Z INFO dispatch www.google-analytics.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.743938Z INFO SNI-rewrite tunnel -> www.google-analytics.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:30.748136Z INFO SOCKS5 CONNECT -> www.google-analytics.com:443
2026-04-25T23:59:30.748211Z INFO dispatch www.google-analytics.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.748220Z INFO SNI-rewrite tunnel -> www.google-analytics.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:30.753445Z INFO SOCKS5 CONNECT -> www.google-analytics.com:443
2026-04-25T23:59:30.753514Z INFO dispatch www.google-analytics.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.753522Z INFO SNI-rewrite tunnel -> www.google-analytics.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:30.756311Z INFO SOCKS5 CONNECT -> www.google-analytics.com:443
2026-04-25T23:59:30.756380Z INFO dispatch www.google-analytics.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.756388Z INFO SNI-rewrite tunnel -> www.google-analytics.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:30.759460Z INFO SOCKS5 CONNECT -> www.google-analytics.com:443
2026-04-25T23:59:30.759520Z INFO dispatch www.google-analytics.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.759528Z INFO SNI-rewrite tunnel -> www.google-analytics.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:30.761251Z INFO SOCKS5 CONNECT -> www.google-analytics.com:443
2026-04-25T23:59:30.761315Z INFO dispatch www.google-analytics.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.761324Z INFO SNI-rewrite tunnel -> www.google-analytics.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:30.769936Z INFO SOCKS5 CONNECT -> www.google-analytics.com:443
2026-04-25T23:59:30.770050Z INFO dispatch www.google-analytics.com:443 -> sni-rewrite tunnel (Google edge direct)
2026-04-25T23:59:30.770058Z INFO SNI-rewrite tunnel -> www.google-analytics.com:443 via 216.239.38.120 (outbound SNI=www.google.com)
2026-04-25T23:59:32.595080Z INFO HTTP GET http://detectportal.firefox.com/success.txt?ipv6
2026-04-25T23:59:32.595080Z INFO HTTP GET http://detectportal.firefox.com/success.txt?ipv4
2026-04-25T23:59:36.049379505Z [ui] stop requested
2026-04-25T23:59:36.049492Z INFO Shutdown signal received, stopping listeners
2026-04-25T23:59:36.049601353Z [ui] proxy stopped
2026-04-25T23:59:36.049798379Z [ui] proxy stopped gracefully
2026-04-26T00:00:59.489687Z INFO h2 fast path active; h1 fallback pool pre-warmed with 1 connection(s)
2026-04-26T00:01:15.866771Z INFO h2 fast path active; h1 fallback pool pre-warmed with 1 connection(s)

its seems,firefox dosent have the certificate.
I tried to install it manually but:
This personal certificate can’t be installed because you do not own the corresponding private key which was created when the certificate was requested.
also ca.crt and ca.key are in same folder.

[Ali-Meshkinghalam]

the same thing happens to me

[therealaleph]

Duplicate of #659 + #959. Firefox uses NSS (its own truststore), not OS truststore. You must import ca.crt via about:preferences#privacy → View Certificates → Authorities → Import → check "Trust this CA to identify websites". Closing as duplicate.