Homelab Private PKI

Install the Root CA certificate

This page provides the public zhousc66 Lab Root CA 2026 certificate for managed devices. After installation, this device can trust internal homelab HTTPS and RDP certificates issued by this CA.

Choose Platform All Files One-Line Install

Verify

Check before installing

Install only this Root CA. Do not install the Intermediate CA as a trusted root. If the downloaded certificate fingerprint does not match the value below, stop and do not install it.

CE:D7:27:9B:6F:B8:F3:92:73:48:48:DD:B5:65:CE:DE:15:28:6E:72:A2:33:E5:51:18:98:D3:A8:95:C2:8F:14

Certificate: zhousc66 Lab Root CA 2026
Validity: 2026-06-09 to 2036-06-06
Purpose: Trust anchor for managed clients

Downloads

Install by platform

Download files directly, or use the scripted install commands for platforms that support system-level scripting.

All downloadable files

Use this if you know exactly which format or installer you need.

iOS profile DER certificate (.cer) PEM certificate (.pem) Linux certificate (.crt) macOS / Linux installer (.sh) Windows PowerShell installer (.ps1) Windows launcher (.cmd) Certificate metadata (.json)

iPhone / iPad

Open this page in Safari, download the profile, install it in Settings, then enable full trust.

Download the `.mobileconfig` profile.
Open Settings and install the downloaded profile.
Go to General > About > Certificate Trust Settings and enable full trust.

Install Profile

Android

Download the DER `.cer` file and install it as a CA certificate from Android security settings.

Download the certificate to the device.
Open Security / Encryption & credentials settings.
Select Install certificate > CA certificate.

Some apps do not trust user-installed CAs. That is controlled by each app.

Download CER

macOS

Use the one-line command, or download PEM/CER and install it into the System Keychain manually.

curl -fsSL https://pki.zhoushicheng.cn/tools/install-root-ca.sh | sh

Manual install:

sudo security add-trusted-cert \
  -d \
  -r trustRoot \
  -k /Library/Keychains/System.keychain \
  ~/Downloads/zhousc66-lab-root-ca-2026.pem

Download SH Download PEM Download CER

Windows

Run PowerShell as Administrator, then use the one-line command or download the installer file.

iex ((New-Object Net.WebClient).DownloadString('https://pki.zhoushicheng.cn/tools/install-root-ca.ps1'))

Manual install:

Import-Certificate `
  -FilePath "$env:USERPROFILE\Downloads\zhousc66-lab-root-ca-2026.cer" `
  -CertStoreLocation Cert:\LocalMachine\Root

Download PS1 Download CMD Download CER

Linux / Raspberry Pi

Use the one-line shell command, or install the CRT manually.

curl -fsSL https://pki.zhoushicheng.cn/tools/install-root-ca.sh | sh

Manual install:

curl -fsSLo /tmp/zhousc66-lab-root-ca-2026.crt \
  https://pki.zhoushicheng.cn/certs/zhousc66-lab-root-ca-2026.crt

sudo install -m 0644 /tmp/zhousc66-lab-root-ca-2026.crt \
  /usr/local/share/ca-certificates/zhousc66-lab-root-ca-2026.crt

sudo update-ca-certificates

Download SH Download CRT