How to remove Russian trusted certificates
This guide can help fix Error 1104: ApiConfigSslError in AmneziaVPN if Russian Ministry of Digital Development certificates are installed on your device. They may have been added manually, through a system profile, a device management profile, an app, an organization policy, or in another way.
A website certificate proves that you connected to the real website. Usually, the browser or app warns you if a certificate has been replaced or is not valid. If Russian Ministry of Digital Development certificates are trusted on the device, the device may accept a certificate from this certificate authority as real and show no warning.
This creates a risk of a man-in-the-middle attack (MITM): when traffic is filtered, an internet provider or another party between you and the website may replace the HTTPS certificate. The browser or app may show no warning, and the website may look like a normal secure website. In this situation, logins, passwords, messages, and other data may be intercepted.
AmneziaVPN also checks the protected SSL/TLS connection. If these certificates interfere with this check, AmneziaVPN may show Error 1104: ApiConfigSslError.
After you remove the certificates, some Russian websites that use certificates from the National Certification Authority of the Russian Ministry of Digital Development may stop opening in a regular browser.
What to remove
First, check whether your device has certificates with these names:
- Russian Trusted Root CA
- Russian Trusted Sub CA
Names may vary depending on when and how the certificate was installed. Look for Russian Trusted Root CA, Russian Trusted Sub CA, Russian Trusted TLS CA, and for The Ministry of Digital Development and Communications or Russian Federation in the issuer field.
Remove only certificates that belong to the Russian Ministry of Digital Development or its National Certification Authority. Do not remove unfamiliar system certificates at random: this may break websites, apps, Wi-Fi, organization network access, or updates.
If the device belongs to your workplace or school, or is managed by an organization, the certificate may have been installed through a management policy. In that case, it may come back after a restart.
Windows 10/11
- Press Win + R, enter
certmgr.msc, and press Enter. - Open Trusted Root Certification Authorities -> Certificates.
- Find Russian Trusted Root CA.
- Right-click the certificate and select Delete.
- Open Intermediate Certification Authorities -> Certificates and delete Russian Trusted Sub CA if it is listed.
- Also check Third-Party Root Certification Authorities -> Certificates.
- Press Win + R, enter
certlm.msc, and press Enter. This step may require administrator rights. - Repeat the same check and removal in the local computer certificate store.
- Restart the device.
Android
Section names may vary depending on the device manufacturer, model, and Android version.
- Open Settings.
- Go to Security & privacy -> More security settings -> Encryption & credentials.
- Open User credentials, User certificates, or Trusted credentials.
- Find Russian Trusted Root CA or Russian Trusted Sub CA.
- Open the certificate and select Delete or Remove.
- Restart the device.
If you cannot find the needed section, use search in settings with these words: certificates, credentials, trusted credentials, or encryption.
iPhone and iPad
- Open Settings -> General -> VPN & Device Management.
- Find the profile that installed Russian Trusted Root CA or Russian Trusted Sub CA.
- Open the profile and select Remove Profile.
- Restart the device.
Also check whether trust for the root certificate is still enabled: Settings -> General -> About -> Certificate Trust Settings.
If you only turn off trust, the certificate may stay on the device. To remove it completely, remove the profile that contains this certificate.
macOS
If the certificates were installed through a profile:
- Open profile settings:
- on macOS 13 or later: System Settings -> General -> Device Management;
- on macOS 12 or earlier: System Preferences -> Profiles.
- Select the profile that contains Russian Trusted Root CA or Russian Trusted Sub CA.
- Click Remove.
- Restart the device.
If the certificates were added directly to Keychain:
- Open Keychain Access.
- Check the login and System keychains.
- Open the Certificates category.
- Find Russian Trusted Root CA or Russian Trusted Sub CA.
- Select the found certificate and delete it. Removing a certificate from the system keychain may require an administrator password.
- Restart the device.
Linux
On Linux, the removal path depends on the distribution and on how the certificate was installed. First, check whether Russian Ministry of Digital Development certificates are listed among trusted system certificates:
trust list --filter=ca-anchors | grep -i -B3 -A1 russ
If the trust command is not installed or prints nothing, go to the file search below. No output does not mean that the certificate is definitely absent: it may be stored in another standard location or installed in another way.
If the command finds Russian Trusted Root CA or Russian Trusted Sub CA, still find the certificate file using the commands below so you know exactly which file to remove.
For Debian, Ubuntu, and distributions based on them:
Find the certificate file:
for f in /etc/ssl/certs/*.pem /usr/local/share/ca-certificates/*.crt; do
[ -f "$f" ] && openssl x509 -in "$f" -noout -subject -issuer 2>/dev/null | grep -i russ && echo " path: $f"
done
The path in /etc/ssl/certs/ helps check that the certificate is present in the system store. If the search finds the same certificate in both /usr/local/share/ca-certificates/ and /etc/ssl/certs/, remove the file from /usr/local/share/ca-certificates/. The path in /etc/ssl/certs/ usually does not need to be removed separately: after sudo update-ca-certificates --fresh, this store will be rebuilt automatically.
If the file is found in /usr/local/share/ca-certificates/, remove it and update the certificate store. In the command below, replace /path/to/found-file with the full path printed by the search command:
Before deleting, make sure the command contains the path to the Russian Ministry of Digital Development certificate file. Do not delete the whole folder and do not use the path to another certificate.
sudo rm "/path/to/found-file"
sudo update-ca-certificates --fresh
For Fedora, RHEL, openSUSE, and distributions based on them:
Find the certificate file:
find /etc/pki/ca-trust/source/anchors -type f -print 2>/dev/null | while read -r f; do
openssl x509 -in "$f" -noout -subject -issuer 2>/dev/null | grep -i russ && echo " path: $f"
done
If the file is found in /etc/pki/ca-trust/source/anchors/, remove it and update the certificate store. In the command below, replace /path/to/found-file with the full path printed by the search command:
Before deleting, make sure the command contains the path to the Russian Ministry of Digital Development certificate file. Do not delete the whole folder and do not use the path to another certificate.
sudo rm "/path/to/found-file"
sudo update-ca-trust extract
If the search command for your system finds nothing, Russian Ministry of Digital Development certificates were not found in the standard Linux system certificate store locations. Do not delete similar-looking files and do not clear certificate folders manually.
In that case, return to the general troubleshooting for Error 1104: check the date and time, try another internet source, and turn off third-party VPN apps, proxies, and network filters. If the error appears again, send new logs to support.
After removal
- Restart the device.
- Open AmneziaVPN and repeat the action that caused Error 1104.
- If the problem remains, check the system date and time, then try another internet source: home Wi-Fi, a wired connection, or another mobile network.
If Error 1104: ApiConfigSslError appears again after removing the certificates, restarting the device, checking the date and time, and changing the internet source, email us at [email protected] or ask for help in our Telegram community.
