scott77

WiFi was turned off completely on the phone, also message itself was a native UI dialog, not something on a webpage.

This is not the message I've seen. There was nothing about TLS, trusted CA installation, emails, apps, or websites.

I wish I've taken a screenshot of it!

Interestingly enough, during last trip to London, my phone (Nexus 5 running Cyanogenmod 12.1) was able to somehow detect something fishy and warned me several times "Network may be monitored by an unknown 3rd party". Among others, I've seen this warning two times out of two when passing by Cheapside/St Martin's corner - next to the St Paul's Cathedral.

At the time I just dismissed this as some tinfoil hat developer adding some nonsensical warnings to the firmware, but in retrospect, after reading this article - this matches perfectly, chances are - phone was indeed detecting Stingrays. Still no idea how it managed to do it.

EDIT: I had no data/IP connection of any kind at and around the time of seeing this, so this is clearly unrelated to TLS interception.