ICAONAV · HTTPS

Why this page exists: browsers give a web page access to the microphone only over HTTPS (or on localhost). An exam records every student's voice, so the iPads, tablets and laptops must open ICAONAV through its HTTPS address, and they must trust the certificate the PC presents. The certificate is issued by a small certificate authority that lives only on this PC ("ICAONAV local CA"); install it once per device, then the HTTPS page opens without any warning. Nothing leaves the PC.

1. The HTTPS address

QR code of the ICAONAV address
reading the addresses…

2. Install the ICAONAV local CA on the device

Open this page on the device itself (same Wi-Fi as the PC: ) and download the certificate; ca.crt is the one every platform takes, ca.pem is the same certificate as text.

Download ca.crt Download ca.pem

iPad and iPhone (iPadOS / iOS)

  1. In Safari tap Download ca.crt; allow the download when Safari asks ("This website is trying to download a configuration profile").
  2. Open Settings: a line Profile Downloaded appears at the top; tap it, then Install (enter the passcode), Install again, Done. If the line is missing, open Settings › General › VPN & Device Management and tap the ICAONAV local CA profile.
  3. Then Settings › General › About › Certificate Trust Settings and switch on full trust for "ICAONAV local CA". Confirm.
  4. Open the HTTPS address above in Safari (or scan the QR code with the camera) and add it to the Home Screen as before.

Android

  1. Download ca.crt (Chrome keeps it in Downloads).
  2. Settings › Security (or Security & privacy) › More security settings › Encryption & credentials › Install a certificate › CA certificate, tap Install anyway and pick the downloaded file. Names differ a little per maker; search the settings for "CA certificate".
  3. Open the HTTPS address in Chrome.

macOS

  1. Download ca.crt and double-click it: Keychain Access opens and adds it (choose the System keychain when asked, or drag the file into System).
  2. In Keychain Access find "ICAONAV local CA", double-click it, open Trust and set When using this certificate to Always Trust. Close the window and enter the password.
  3. Open the HTTPS address in Safari or Chrome.

Windows

  1. Download ca.crt, double-click it, Install Certificate…, Current User, Place all certificates in the following store, Browse…, choose Trusted Root Certification Authorities, Next, Finish and confirm the security warning. (The same through certmgr.msc: Trusted Root Certification Authorities › Certificates › right-click › All Tasks › Import.)
  2. Open the HTTPS address in Edge, Chrome or Firefox. Firefox has its own store: Settings › Privacy & Security › Certificates › View Certificates › Authorities › Import, or switch on security.enterprise_roots.enabled in about:config so it uses the Windows store.
  3. On the ICAONAV PC itself nothing is needed: http://localhost is allowed to use the microphone.

3. Check

Open the HTTPS address: the browser shows no warning and a lock (or nothing at all) next to the address. On the pilot page the exam overlay can then switch the microphone on. If a warning still appears, the device did not get full trust (iPad: step 3) or the address is not one of the names in the certificate (see the list under the QR code: the certificate is reissued automatically when the PC's addresses change; restart ICAONAV after moving to another network).

The certificate authority is valid for ten years, the server certificate for two; both renew themselves. To start over, stop ICAONAV, delete the folder %LOCALAPPDATA%\ICAONAV\certs and start it again (the devices then need the new CA).