Verify this SHA-256 on the device before trusting:
B9:64:99:EF:2F:FB:CA:78:8D:99:6C:52:FE:5E:8B:6F:81:49:57:FE:36:31:43:2D:45:39:4E:0E:9F:53:61:FA
Android: Settings → Security & privacy → Encryption & credentials → Install a certificate → CA certificate. Note: only browsers/opt-in apps use user-installed CAs on Android 7+.