[8organicbits]

One alternative is to use public CAs on your private networks. I've been working on tooling for this at getlocalcert [1]. Side stepping the need to add a trust root makes the public on private approach a net win for some networks. I honestly wasn't expecting Android to block private CAs, but I guess here we are.

[1] https://www.getlocalcert.net/

[Hackbraten]

That looks super convenient! However, some reverse engineering tasks would still require root CA certificates, for example observing app traffic.