beem docs

Root Certificate Authority ​

To use the beem app, you must have the Swisscom beemNet Root CA installed on your device. A Root CA is a trusted authority that issues digital certificates: credentials that prove a website, server, or app is legitimate. Your device keeps a list of Root CAs it trusts. If a certificate was issued by one of them, your device treats the associated connection as secure.

Swisscom beemNet Root CA ​

Many online threats (such as phishing and malware) are hidden inside encrypted HTTPS traffic, making them invisible to standard security tools. To detect them, the beem app acts as a trusted proxy on your device, using the Swisscom beemNet Root CA to securely inspect encrypted connections without disrupting your browsing.

The Swisscom beemNet Root CA is issued directly by Swisscom and works exclusively on your device in conjunction with the beem app. It is used strictly to identify and block security threats, and only affects traffic routed through the beem app. It does not give anyone access to your private data, and it does not monitor your activity.

Among other things, it enables the following advanced security features:

  • TLS/SSL inspection: Decrypting and analysing secure traffic to detect threats like phishing, malware, or man-in-the-middle attacks.
  • Zero Trust policies: Verifying traffic not just at the network perimeter but continuously, including encrypted payloads.
  • Secure content filtering: Blocking known malicious domains or content based on real-time threat intelligence.

Root CA management ​

The beem app will guide you step by step through the installation.

  • On iOS, you can manage the Root CA under Settings → General → VPN & Device Management.

  • On Android, you can manage the Root CA under Settings → Security & privacy → More security settings → Encryption & credential.

If you delete the Root CA or its trust is revoked, the beem app will automatically reinstall it.

  • iOS and Android: The next time the beem app is opened, onboarding screens will guide you through reinstalling the Root CA or renewing trust. The beem app will remain in this state, and connecting to beemNet will be disabled, until the Root CA is successfully reinstalled and trusted.
  • macOS: The Root CA is reinstalled during the next reconnection to beemNet. macOS will prompt for authentication, and your successful authentication confirms the installation. If you do not confirm, the beem app will display a permanent message and will block the connection to beemNet.
  • Windows: The Root CA is silently reinstalled in the background.

For more information on managing Root CAs on mobile devices ​

iOS: Install a configuration profile
iOS: Review and delete configuration profiles
Android: Add and remove certificates

Firefox Root CA setup ​

When you install the beem app, the Swisscom beemNet Root CA is added automatically to your operating system's trust store. Browsers such as Chrome and Safari use this central trust store, so they trust it right away.

Firefox works differently: it keeps its own trust store, separate from the operating system's. Until the Swisscom beemNet Root CA is added there manually, Firefox will not trust connections secured by beem, which can cause websites to display incorrectly or show security warnings.

To fix this, add the Swisscom beemNet Root CA to Firefox manually:


Add the Swisscom beemNet Root CA to Firefox

Follow these steps to add the beemNet certificate to Firefox and restore the correct display of websites.

1. Download the Root CA
For an Essential tenant, you can do this directly: Download Swisscom beemNet CA.
For a Standard, Plus, or Premium tenant, your administrator provides the Root CA to you.

2. Open Firefox certificate settings
Go to Settings → Privacy and security.
Under Connection and software security, click Advanced settings.

3. Open the certificate manager
Scroll to the Certificates section and click Manage certificates.

4. Import the Root CA
In the certificate manager, open the Authorities tab and click Import….
Select the SwisscombeemNet.crt file you downloaded in step 1.

5. Trust the certificate
Enable Trust this CA to identify web sites. and click Ok.
Then click Ok again to close the certificate manager.

6. Restart Firefox
Close and reopen Firefox. Websites should now display correctly.