Certificate Configuration, Management, and Installation for HTTPS Proxy Capture with TraceEagle

Certificate Management and Installation To capture HTTPS with a proxy, the first step is to make devices and software trust this tool's root certificate-if not trusted, TLS errors occur, and you can only see garbled ciphertext. This article walks you through installing the certificate step by step: one-click installation on the local machine, QR code installation on mobile, and how to use Full Coverage to supplement programs that 'still don't trust it even after the system certificate is installed' (Java / Python / curl, etc.). Install once, and all subsequent sessions can be decrypted. I. When to Use Whenever you use proxy capture for HTTPS and want to see plaintext, you need to install the certificate first. Typical scenarios: - Before using proxy capture for HTTPS for the first time: The local machine has not yet trusted the root certificate; install it once first. See Proxy Capture. - Mobile capture: The phone must separately trust the root certificate once; QR code installation is the fastest. See iOS Capture, Android Capture. - Java / Python / curl / wget, etc. cannot decrypt: These programs only recognize their own certificate list. Even after the system certificate is installed, they still cannot decrypt-use Certificate Full Coverage to install the certificate directly into them. If you use proxy-free capture methods such as Specified Program Capture or Application-Layer Capture, you usually do not need to install certificates, and can skip this article. II. Prerequisites - TraceEagle has been installed and started (for the first startup, just agree to the system permissions). - Open the Certificate Management page (all certificate-related operations are here: local trust status, download, mobile QR code, full coverage, client certificates). - When installing the certificate by scanning the QR code on your phone, the phone and computer must be on the same LAN. III. Step-by-Step Operations The scenarios below are numbered; just follow the one you need. A is the first step everyone must do. A. Local One-Click: Install and Trust on the Local Machine To capture local traffic, first make the local machine trust the root certificate. - Open Certificate Management and check Local Trust Status-if it shows 'Not Trusted,' continue to the next step; if it already shows 'Trusted,' you can skip. - Click 'Install to Local Machine and Trust', and confirm according to system prompts (you may need to enter your login password once). - When the status changes to 'Trusted', it is complete. Installing once is enough; all subsequent sessions can decrypt HTTPS. If you need to distribute it manually or use it with other tools, you can use 'Download Root Certificate' on the same page; multiple formats are provided, use as needed. B. Mobile QR Code Installation The phone must separately trust the root certificate once. The root certificate is globally universal; install it only once per device. - On the Certificate Management page, find Mobile QR Code Installation. The tool generates a QR code for each available address on the LAN. - Use your phone camera to scan the code, open the installation page, and install it according to the corresponding system below: - iOS: First follow the page prompt to download the profile, then go to Settings → General → VPN & Device Management to install the profile; after installation, also go toSettings → General → About → Certificate Trust Settings to enable full trust for this root certificate (if you skip this step, iOS still cannot decrypt). See iOS Capture for details. - Android (regular device): Open the installation page and install the root certificate as a user certificate / CA certificate. Note that some apps only recognize system certificates and do not recognize user certificates; if you encounter decryption failures, see Android Capture]. - Android (rooted device): You can directly install the root certificate into the system certificate store, eliminating manual import and providing the best compatibility. - iOS: First follow the page prompt to download the profile, then go to - After installation, return to the App and generate an HTTPS request to confirm decryption works. C. Certificate Full Coverage: Decrypt Even Programs That 'Do Not Recognize System Certificates' Some programs still cannot decrypt even after the system certificate is installed-they only recognize their own certificate list. Full Coverage can install the root certificate directly into these programs: - On the Certificate Management page, open Certificate Full Coverage. The tool will automatically discover such software on the local machine (including running software), list them one by one, and mark them as Installed / Not Installed. Common ones include: - Java programs - Python programs - Command-line and scripting tools such as curl / wget / Ruby / PHP / git - Software such as Firefox / Thunderbird - For items not installed, click Install to install the root certificate; to revoke, click the corresponding Remove. - For missed ones that automatic discovery did not find (installed in non-standard paths, or not recognized by the tool), use manual path entry to add them, then install. This is exactly the long-standing pain point of ordinary capture tools: the certificate is installed, but the program still cannot decrypt. Full Coverage specifically solves this. D. Client Certificate Import If the target site requires a client certificate (mutual authentication), and you happen to have one: - Open the Client / Domain Certificate page. - Import your client certificate (enter the password as well, if any). - After that, when capturing these sites, the handshake and decryption will work normally. IV. Verification: Confirm Installation and Decryption - Local machine: Return to the Certificate Management page; the local trust status shows 'Trusted'. - Decryption works: Generate an HTTPS request through the proxy, open the details in the request list, and TLS shows 'Decrypted', with the response being readable plaintext (such as JSON) rather than garbled text. - Full Coverage / Mobile: HTTPS requests from the corresponding program or mobile App can also be seen in plaintext. For how to read details, switch views, and decode, see Data Viewing and Decoding. V. Installed but Still Cannot Decrypt? Check Item by Item | Symptom | Likely Cause | What to Do | |---|---|---| | The local machine has a system certificate installed, but a program still shows only ciphertext | This program only recognizes its own certificate list (typically Java / Python / curl / Firefox) | Use C. Certificate Full Coverage to install the certificate into it; for ones not listed by automatic discovery, use manual path entry | | The phone has a certificate installed, but the App still cannot capture plaintext | The App only recognizes system certificates, does not recognize user certificates, or has certificate pinning | On Android, use a rooted device to install it into the system store; if it still fails, it is likely pinning-see Bypassing Certificate Pinning | | iOS still reports an error after the profile is installed | You missed the Full Trust switch in 'Certificate Trust Settings' | Go to Settings → General → About → Certificate Trust Settings and enable trust for this root certificate-see iOS Capture | | A program cannot be found in Full Coverage | It is installed in a non-standard path, so automatic discovery did not cover it | On the Full Coverage page, use manual path entry to point to it, then install | | It is installed but still cannot decrypt, and what is captured is its proprietary encryption | The target does not use standard TLS, so certificates cannot solve it | Switch to Application-Layer Capture to obtain plaintext from inside the program | Next Steps - Once the certificate is installed, you can start capturing: return to Proxy Capture. - Full mobile workflow: see iOS Capture, Android Capture. - The certificate is installed, but the App uses certificate pinning and cannot be captured: see Bypassing Certificate Pinning. - How to read and decode after capturing: see Data Viewing and Decoding. Top comments (0)