Shouldn't Android/Firefox work with default rootCA?

## Environment
two sections:
* dev machine: called "hiss", ubuntu 24, mkcert 1.4.4
* client device: android, stock firefox,

## What you did
* read [mkcert.org ](https://mkcert.org/) website
* Read, by default, mkcert will use mozilla rootCA
* installed mkcert from your github to hiss
* mkcert -install
* mkcert "$PROD_URL" localhost "$MY_LAN_IP" ::1
* copy files to relevant directory, restart my App
* from hiss, curl -v https://$PROD_URL:3001/
* get much debug, NO SSL ERRORS
* also on hiss in Chrome, open https://$PROD_URL:3001/
* GUI SSL validation reports NO SSL ERRORS
* swap to phone, open firefox
* paste URL,
* "end user details" error message, but looks like rootCA mismatch

## What went wrong
Am I confused that the Mozilla rootCA is applied as a default in mkcert, and this will be used in android/ firefox by default?
I can't copy the standard text as FF keeps trying to help by redirecting to google.
it says in end user level of detail that the cert isn't valid, and I infer the roortCA is mis-matching

Start by reproducing the reported sequence on Android stock Firefox: install mkcert, run mkcert -install, generate the certificate, and open the URL from the phone. Compare the Android/Firefox result with curl and Chrome on hiss. Done means determining whether the default rootCA is expected to work there and documenting the required trust setup or the specific failure.

Written by the indexing model from the issue text.