Certificate Management and Installation
To capture HTTPS with a proxy, the first step is to make devices and applications trust this tool's root certificate—otherwise you get TLS errors and cannot decrypt. Certificate management makes this one-click and comprehensive: local machine, mobile, and even apps that "still don't trust it despite system certificates installed" can all get the certificate installed.
1. One-click installation on the local machine
- Check at any time whether the local machine already trusts this tool's root certificate.
- One-click "Install to local machine and trust". Install once, and all subsequent sessions can decrypt HTTPS.
- When needed, download the root certificate (multiple formats) for manual distribution.
2. Mobile QR-code installation
- Generate a QR code for every available LAN address. Scan it with the mobile camera, open the installation page, and install the certificate—both iOS and Android are supported.
- iOS also provides one-click configuration profile installation.
- Rooted Android devices can install the root certificate directly into the system certificate store, eliminating manual import.
- The root certificate is globally universal; each device only needs to trust it once.
3. Full certificate coverage: even apps that "don't trust system certificates" can be decrypted
Some apps still cannot be decrypted even after system certificates are installed—they only trust their own certificate list. Full certificate coverage can install the root certificate directly into these apps, allowing them to be decrypted:
- Java applications
- Python applications
- curl / wget / Ruby / PHP / git and other command-line and scripting tools
- Firefox / Thunderbird and other software
The tool automatically discovers these applications on the local machine (including running ones) and shows "installed / not installed" for each. If auto-discovery misses some, you can manually enter the path to add them.
This is exactly the longstanding pain point of ordinary packet capture tools: the certificate is installed, but the application still cannot be decrypted. Full certificate coverage is designed specifically for this.
4. Client certificates
If the target site requires a client certificate and you happen to have one, you can import it (including the password) on the "Client / Domain Certificate" page. Then you can decrypt these sites normally.
5. When to use
- Before using the proxy to capture HTTPS for the first time, first make the local machine / mobile trust the root certificate.
- Mobile packet capture: scan the QR code to install the certificate.
- When the target is a Java / Python / curl / Firefox app and decryption fails: use full certificate coverage to install the certificate into them.
Top comments (0)