MadBlocker uses the VPN subsystem for filtering, even though the traffic doesn't leave the device. In order for the VPN profile to work with the On Demand VPN system (used for sending ad domain requests to 127.3.5.7), it has to use cert-based auth, and MadBlocker is using a self-signed certificate so I could use a reasonable expiration time (ten years) without paying a ton of money for a cert signed by a commercial CA. It seemed silly to pay for a cert that sees no use. I had actually used a proper cert earlier in testing, but figured people would get frustrated with the one-year expiration time.