Here I was told how to achieve this, but you will need to repeat the procedure after each update, which creates more problems than periodically seeing ads.
https://4pda.ru/forum/index.php?showtopic=438451&st=13280#entry93979947
If there is a root, then everything is of course easier, you can move the certificate to the system storage and the problem is solved