Certificate Configuration, Management, and Installation for HTTPS Proxy Capture with TraceEagle

To capture HTTPS traffic via a proxy, the initial step is to ensure the device and software trust the root certificate of the tool being used. Without this trust, TLS errors occur, resulting in garbled ciphertext. This article provides a detailed guide on installing the certificate, covering three main sections: local one-click installation on the machine, QR code installation on mobile devices, and utilizing Full Coverage to install the certificate into programs that still do not recognize the system certificate. Once installed, all subsequent sessions can decrypt HTTPS traffic.

When employing proxy capture for HTTPS, the certificate installation process is necessary. Common scenarios include the first-time use of proxy capture for HTTPS on a local machine, where the system hasn't trusted the root certificate; on mobile devices, where the phone must separately trust the root certificate; and when programs like Java, Python, curl, or wget cannot decrypt the traffic.

In such cases, the Certificate Full Coverage feature comes into play, installing the root certificate directly into these programs. If proxy-free capture methods like Specified Program Capture or Application-Layer Capture are used, certificate installation is usually unnecessary.

Before proceeding with the installation, ensure TraceEagle is installed and running. Access the Certificate Management page, where all certificate-related operations are centralized. For mobile installations, both the phone and computer must be connected to the same LAN. The guide is presented in four main steps:

A. Local One-Click: Install and Trust on the Local Machine. This step ensures the local machine trusts the root certificate. Navigate to Certificate Management, check the Local Trust Status, and if it shows "Not Trusted," proceed to install and trust the certificate. The installation is a one-time process, and all subsequent sessions can decrypt HTTPS traffic. The certificate can also be downloaded for manual distribution or use with other tools.

B. Mobile QR Code Installation. The root certificate must be trusted by the mobile device separately. Once installed globally, the phone must scan the QR code generated by TraceEagle on the Certificate Management page to install the certificate. For iOS devices, after downloading the profile and installing it through the Settings, enable full trust for the root certificate in the Certificate Trust Settings.

For Android devices, install the certificate as a user or CA certificate, with some apps only recognizing system certificates. After installation, generate an HTTPS request to confirm successful decryption.

C. Certificate Full Coverage: Decrypt Even Programs That Do Not Recognize System Certificates. Some programs still cannot decrypt traffic even after the system certificate is installed, as they only recognize their own certificate list. The Full Coverage feature installs the root certificate directly into these programs. Navigate to the Certificate Management page, open Certificate Full Coverage, and the tool will automatically detect software on the local machine, including running programs, and list them.

Any software that hasn't been installed will be marked as "Not Installed," allowing you to click "Install" to add the root certificate. For software not automatically discovered, manually enter the path to add it and then install the certificate.

D. Client Certificate Import. If the target site requires a client certificate for mutual authentication, and you possess one, import it through the Client / Domain Certificate page. Provide the password if required. This step enables normal decryption when capturing these sites.

To verify the installation, return to the Certificate Management page and check the local trust status, which should show "Trusted." Generate an HTTPS request through the proxy; the details of the request should display "Decrypted," and the response should be readable plaintext rather than garbled text. This concludes the certificate configuration process.