Getting your private CA trusted on a smartphone seems to keep getting more and more difficult and/or annoying with every iteration of the various mobile OSes.

Getting your private CA trusted on a smartphone seems to keep getting more and more difficult and/or annoying with every iteration of the various mobile OSes. If it was possible to make a private CA cert that was only valid for hosts under a single domain, and then for mobile devices to STFU about you wanting to install it (as it wouldn't be as "risky" from their POV), life would be a little easier.