Intercepting traffic on Android with Mainline and Conscrypt

The report explains how Android’s move to Mainline/Conscrypt-managed root CAs affects TLS interception and details updates to the AlwaysTrustUserCerts Magisk module to restore interception from Android 7 through Android 16 Beta. It covers copying user certificates to the system store, rbind-mounting into the Conscrypt APEX across zygote and child processes, handling Google Play System Updates and SDK gating (A14+), addressing Android 15+ mount propagation with rbind, and ensuring resilience by reinjecting mounts after zygote restarts while preserving CA disablement behavior.