SkieWhy does Skie block installing certificates on managed devices?
A user-installed certificate can let someone intercept or reroute encrypted traffic, or help a bypass tool pass as trusted. Skie blocks installing certificates and credentials with Android's config credentials restriction, and it is on by default. The device keeps only the certificates it shipped with.
Certificates are how a device decides whom to trust on the internet. Adding one by hand tells the device to accept a source it would otherwise reject. Some proxy and filter-evasion tools ask for exactly that, so they can see or reshape traffic.
Skie sets DISALLOW_CONFIG_CREDENTIALS as the device owner. In Settings, the options to install a certificate from storage, or to manage user credentials, are unavailable. This protects the filtered, encrypted path described in the entries on Private DNS and VPN setup, because a bypass cannot add itself as a trusted party.
It is a default protection, listed in the hardening section. The device reports its state back from Android after every apply, and the compliance score includes it.
Does it affect normal school use? Rarely. Learning platforms and websites rely on certificates that are already part of Android. A school that runs its own network inspection with a custom certificate would need to talk with Skie about how to arrange that, because the default assumes no need for one.
Practical tip: if your IT team deploys a private root certificate for a campus system, plan it before you roll out the protection to that group, and test on one tablet first.