Serve the CA certificate for browsers/mobile at http://mitmux.cert/

Browser/mobile setup previously meant "find ca.pem on disk and import
it manually" - awkward on a phone or tablet especially, which has no
convenient way to get a file onto the device at all short of emailing
it to yourself or similar. Any client already configured to proxy
through mitmux can now just visit http://mitmux.cert/ and get the cert
directly, with Content-Type: application/x-x509-ca-cert triggering
iOS/Android's native "install this certificate" prompt.

Same idea as mitmproxy's own http://mitm.it/, arrived at independently
rather than reusing their domain - mitmux.cert isn't a registered TLD,
so it can never collide with a real site someone meant to visit.
Deliberately HTTP-only: fetching it over HTTPS would require the client
to already trust mitmux's CA to MITM that very connection, the exact
chicken-and-egg problem this exists to solve, so it's not attempted on
the CONNECT/TLS path at all.

internal/proxy/proxy.go: isCertDownloadHost matches the hostname
case-insensitively regardless of port; handleHTTP checks it before
ever dialing upstream and answers directly via serveCACert, using the
CA's own CertPEM bytes already held in memory. Short-circuits before
record() is ever reached, so the download itself never pollutes
history.

Verified live: fetched http://mitmux.cert/ through a real running
proxy and confirmed the downloaded bytes are byte-identical to the
actual ca.pem on disk (diff, not just "the request succeeded");
confirmed a request with an explicit port and a path still matches;
confirmed normal proxying to an unrelated host is completely
unaffected; confirmed via direct SQLite query that the cert-download
requests never appear in history while a normal request in the same
session does.

Also documented (no code needed): any standard proxy-switcher extension
(FoxyProxy, etc.) or a phone/tablet's own Wi-Fi proxy setting already
works with mitmux exactly like it would with Burp/ZAP/Caido, since it's
a normal forward proxy speaking the standard protocol. This was true
before but never actually spelled out in the README for the phone/
tablet case specifically, which is a real, common daily workflow.

go build/vet/gofmt/test/mod tidy all clean.

1 files changed, 21 insertions, 1 deletions

diff --git a/README.md b/README.md
index 393b0bc..dfa9f87 100644
--- a/README.md
+++ b/README.md
@@ -144,13 +144,33 @@ shorter `-socket /tmp/mitmux.sock` (and the matching `-socket` to
    trust store itself. Installing a root CA is a system-wide trust
    change, so you run the printed command yourself.
 
+   For a phone, tablet, or any other device where copying a file over
+   and importing it manually is awkward - the actual common case for
+   mobile testing - point the device's browser at
+   **`http://mitmux.cert/`** once it's configured to proxy through
+   mitmux (step 3). mitmuxd recognizes that hostname specifically and
+   serves its own CA certificate as a download, the same trick
+   [mitmproxy's `mitm.it`](https://mitm.it) uses: no DNS lookup, no
+   real domain, works the moment traffic is flowing through the proxy
+   at all - the browser's install-certificate prompt handles the rest.
+   Plain `http://`, not `https://`: fetching it over TLS would need the
+   device to already trust mitmux's CA to intercept that very
+   connection, which is the exact problem this page solves.
+
 3. **Point a client at the proxy.** e.g.:
 
    ```sh
    curl -x http://127.0.0.1:8080 --cacert ~/.config/mitmux/ca.pem https://example.com/
    ```
 
-   Or configure your browser's proxy settings to `127.0.0.1:8080`.
+   Or configure your browser's proxy settings to `127.0.0.1:8080` -
+   directly, or via a proxy-switcher extension like
+   [FoxyProxy](https://getfoxyproxy.org/): add a new proxy profile
+   pointing at `127.0.0.1:8080` (HTTP, and reused for HTTPS - mitmux
+   handles both on the same listener), no mitmux-specific setup needed
+   since it's a standard forward proxy speaking the same protocol Burp/
+   ZAP/Caido all do. Same story for a phone or tablet: set its Wi-Fi
+   proxy to your machine's LAN address and the daemon's port.
 
 4. **Open the TUI** (in another terminal - the daemon keeps running
    independently):