Certificate Configuration, Management, and Installation for HTTPS Proxy Capture with TraceEagle
This guide walks readers through the essential steps to trust TraceEagle’s root certificate for decrypting HTTPS traffic. It covers one‑click local installation, QR‑code mobile setup, and special handling for programs that ignore system certificates. After installation, users can view plaintext tra…
When you want to see the contents of HTTPS traffic in a proxy, the first hurdle is trust. Without a trusted root certificate, browsers and applications will refuse to connect, and the data you capture will appear as unreadable ciphertext. TraceEagle solves this by allowing you to install its root certificate on any device that will be routed through the proxy. The process is straightforward once you understand the steps and the context in which each step applies.
Why a Root Certificate Is Needed
HTTPS protects data by encrypting it with TLS. The server presents a certificate signed by a trusted authority, and the client verifies that signature. When a proxy intercepts the traffic, it must present its own certificate to the client. If the client does not trust the proxy’s root certificate, the TLS handshake fails, and the proxy can only record encrypted data. Installing the root certificate tells the client to treat the proxy’s certificates as legitimate, enabling full decryption.
When to Install the Certificate
There are three common scenarios that require certificate installation:
- First‑time proxy use on a machine – the system has never seen the TraceEagle root, so install it once.
- Mobile device capture – phones need a separate trust installation, typically via a QR code.
- Specialized tools (Java, Python, curl, wget, etc.) – these applications maintain their own certificate stores and may ignore the system store.
If you are using a proxy‑free method such as application‑layer capture, you can skip certificate installation entirely.
Prerequisites and Initial Setup
Before you begin, launch TraceEagle and accept any system permissions it requests. Open the Certificate Management page; all certificate‑related actions are centralized here. For QR‑code installation, ensure your phone and the computer are on the same local network.
Step‑by‑Step Installation
Follow the scenario that matches your environment. Each step is self‑contained and can be executed independently.
A. Local One‑Click Installation
Navigate to the Certificate Management page and check the Local Trust Status. If it shows “Not Trusted,” click Install to Local Machine and Trust. Confirm any system prompts, which may require your administrator password. Once the status changes to “Trusted,” the installation is complete. The certificate file is also available for download in multiple formats if you need to distribute it manually.
B. Mobile QR Code Installation
On the same page, locate the Mobile QR Code Installation section. TraceEagle generates a QR code that points to the local machine’s address. Scan the code with your phone’s camera. The installation process differs by platform:
- iOS – download the profile, then go to Settings → General → VPN & Device Management to install it. After installation, enable full trust by navigating to Settings → General → About → Certificate Trust Settings and toggling the root certificate.
- Android (non‑rooted) – install the certificate as a user CA certificate. Some apps only recognize system certificates, so if decryption fails, consider rooting or using the Full Coverage method.
- Android (rooted) – install the certificate directly into the system store for maximum compatibility.
C. Certificate Full Coverage for Program‑Specific Stores
Programs like Java, Python, curl, and Firefox maintain separate certificate stores. Even after installing the system root, these tools may refuse to trust the proxy’s certificates. The Certificate Full Coverage feature automatically discovers such programs on your machine, lists them, and allows you to install the root certificate directly into each store. For any program not detected automatically, use the manual path entry to add it.
D. Importing Client Certificates
If you are capturing traffic that requires mutual authentication, import the client certificate on the Client / Domain Certificate page. Provide the certificate file and its password. Once imported, the proxy can complete the TLS handshake and decrypt the traffic.
Verification and Troubleshooting
After installation, confirm that the proxy can decrypt traffic:
- On the local machine, generate an HTTPS request through the proxy and check the request details. The TLS section should display “Decrypted” and the response should be readable JSON or HTML.
- On mobile or specialized programs, observe that the captured traffic appears in plaintext in TraceEagle’s interface.
If decryption still fails, consult the troubleshooting table below:
- Local machine shows “Not Trusted” after system installation – ensure you have restarted any applications that were running during installation.
- Mobile app fails after QR code installation – on iOS, double‑check that the full trust toggle is enabled; on Android, confirm the certificate is in the system store.
- Java or Python still refuse the certificate – use Full Coverage to install the root into the specific JRE or Python environment.
- App uses certificate pinning – see the dedicated guide on bypassing pinning for that platform.
Once the root certificate is trusted, you can start capturing traffic in the Proxy Capture view. For a complete mobile workflow, refer to the platform‑specific capture guides.
Next Steps
With the certificate in place, you can explore advanced features such as filtering, session replay, and data decoding. The TraceEagle interface provides detailed views of each request, allowing you to inspect headers, bodies, and TLS parameters. For more on how to read and decode captured data, consult the Data Viewing and Decoding documentation.
In summary, installing the root certificate is the foundational step that unlocks full visibility into HTTPS traffic. By following the local, mobile, and program‑specific procedures outlined above, you can ensure that all traffic routed through TraceEagle is decrypted and ready for analysis.
Why it matters
Trusting the proxy’s root certificate is essential for decrypting HTTPS traffic, enabling security analysts to inspect, debug, and audit encrypted communications without compromising security protocols.
Key points
- Install the root certificate once per device to decrypt HTTPS traffic.
- Use QR codes for quick mobile installation and enable full trust on iOS.
- Full Coverage installs the certificate into program‑specific stores like Java and Python.
- Verify decryption by checking the TLS status in TraceEagle’s request details.
- Troubleshoot failures by ensuring the certificate is in the correct store and pinning is addressed.
Frequently asked questions
Why does my mobile app still show encrypted traffic after installing the QR code?
On iOS you must enable full trust for the root certificate in Settings → General → About → Certificate Trust Settings. On Android, some apps only use system certificates; installing the certificate in the system store or rooting the device may be required.
Can I use the same root certificate on multiple machines?
Yes, the root certificate is universal. Download it from the Certificate Management page and install it on each machine or device you want to capture traffic from.
What if a program like curl refuses to trust the proxy certificate even after system installation?
Use the Certificate Full Coverage feature to install the root into curl’s own certificate store, or manually add the path to curl’s configuration.
