HTTPS certificate · cross-client guide
The one WLOC setup step everyone misses: trusting the certificate
You installed the module. The VPN icon is showing. But WLOC diagnostics say 'HTTPS not found'. Sound familiar? You skipped the certificate trust step — and you are not alone. This guide explains what a CA certificate is (in plain English), why WLOC needs one, and exactly where to tap in iOS Settings for each client. Four steps. Five minutes. No jargon.
Plain English
What is a CA certificate, and why does WLOC need one?
Apple's location servers use HTTPS — the same lock-icon encryption that protects your banking. To inspect and modify the location data inside that encrypted traffic, your VPN client needs to briefly decrypt it, change the location bits, and re-encrypt it. A CA certificate is the digital key that makes this possible. Think of it like this: your VPN client is a mailroom that opens a sealed envelope, swaps one page, and reseals it. The CA certificate is the official stamp that says 'this mailroom is allowed to do that — but only for these two specific envelopes.' The two envelopes are Apple's WPS servers. Nothing else. That scoping is what keeps it safe.
These are the ONLY two hosts WLOC needs to decrypt — add only these, nothing else:
gs-loc.apple.comgs-loc-cn.apple.comWhere to find 'Generate CA' in each client
| Client | Steps |
|---|---|
| Shadowrocket | Settings → HTTPS Decryption → toggle ON → tap Generate CA |
| Surge 5 | Settings → MitM → toggle ON → tap Generate CA |
| Quantumult X | Settings → MitM → Generate CA |
| Loon | Settings → MitM → Generate CA. Then: Plugin tab → WLOC plugin → certificate path → select Loon CA |
| Stash | Settings → MitM → Generate CA |
| Egern | Settings → MitM → Generate CA. Important: do NOT reuse a CA from another client |
Step 1：Generate the CA certificate inside your client
Every compatible client has a 'Generate CA' button in its settings. Find it. Tap it. This creates a certificate authority — a digital key — on your device. It only exists on this phone. It is not shared with anyone. Each client's CA is unique to that app, so if you switch from Surge to Shadowrocket, you need to generate a new one.
- Shadowrocket: Settings → HTTPS Decryption → Generate CA
- Surge: Settings → MitM → Generate CA
- Quantumult X: Settings → MitM → Generate CA
- Loon: Settings → MitM → Generate CA (plus set certificate path in plugin)
- Stash: Settings → MitM → Generate CA
- Egern: Settings → MitM → Generate CA (do NOT reuse from Surge)
Step 2：Install the profile in iOS Settings
After generating the CA, iOS shows a notification: 'Profile Downloaded'. Or you might see nothing — that is fine too. Go to Settings → General → VPN & Device Management. You should see a new profile with your client's name. Tap it. Tap 'Install' in the top-right corner. Enter your device passcode if asked. This step registers the certificate with iOS. But you are not done yet — the next step is the one everyone misses.
- Path: Settings → General → VPN & Device Management → tap the profile → Install → enter passcode
- If you do not see a profile, go back to your client and tap 'Generate CA' again
- The profile name will include your client's name (e.g., 'Shadowrocket CA', 'Surge CA')
Step 3：Trust the certificate — the step everyone misses
Installing the profile is only half the job. iOS still does not trust the certificate for HTTPS decryption. You have to explicitly enable trust. Go to Settings → General → About → Certificate Trust Settings. Find your client's CA under 'Enable Full Trust For Root Certificates'. Toggle it ON. iOS will show a warning — this is normal. Tap 'Continue'. This is the step that fixes the 'HTTPS not found' error in WLOC diagnostics. If you only remember one thing from this guide: Certificate Trust Settings. Under About. Toggle ON.
- Path: Settings → General → About → Certificate Trust Settings → toggle ON for your client's CA
- This is buried under About — not under VPN & Device Management
- iOS shows a warning popup. This is normal. Tap Continue.
- If you skip this step, diagnostics will say 'HTTPS not found' every single time
Step 4：Verify it works, then know how to remove it
Open WLOC, save a test target, and run diagnostics. If the CA is trusted correctly, you should see a non-zero patch count — that is your proof. When you are done testing: go back to Certificate Trust Settings and toggle the CA OFF (or remove the profile entirely from VPN & Device Management). Then disable HTTPS Decryption/MitM in your client. Leaving a trusted CA on your device is a security risk if you ever sell or give away the phone. Clean up when you are done.
- Patch count > 0 in WLOC diagnostics = certificate is working
- To remove: Settings → General → VPN & Device Management → tap profile → Remove
- Also toggle OFF in Certificate Trust Settings
- Disable HTTPS Decryption / MitM in your client when not in use
FAQ
Why is Certificate Trust Settings buried under About?
Good question. It is an odd place for it, and Apple moves it between iOS versions. As of iOS 18+, it lives under Settings → General → About → Certificate Trust Settings. On older iOS versions it was under Settings → General → About. This is probably the single biggest reason people miss this step — it is not where anyone would look.
Do I need to do this for every client?
Yes. Each client generates its own CA certificate. If you switch from Surge to Shadowrocket, you must generate a new CA, install the new profile, and trust the new certificate. The old one does not carry over.
Is it safe to trust a CA certificate?
When scoped correctly — yes. The WLOC module limits HTTPS decryption to exactly two hosts: gs-loc.apple.com and gs-loc-cn.apple.com. Those are Apple's Wi-Fi Positioning System servers. Nothing else is decrypted. If you ever expand that host list or enable catch-all decryption, that is a privacy risk. Keep the scope tight, and remove the certificate when you are done testing.
What if I see 'Profile Downloaded' but cannot find it in Settings?
Try closing and reopening Settings. On some iOS versions the profile appears under Settings → General → VPN & Device Management only after a Settings app restart. If it still does not appear, the CA may not have been generated successfully — go back to your client and tap Generate CA again.
WLOC
Five minutes. Four steps. No more 'HTTPS not found'.
The certificate trust step trips up almost everyone. Now you know exactly where it is. Generate → Install → Trust → Verify. Do not skip step three.