3 ms·

I believe Fiddler does this edit: Details on the process: http://blogs.telerik.com/fiddler/posts/13-08-19/faq---certificates-in-fiddler http://blogs.telerik.c

I believe Fiddler does this edit: Details on the process: http://blogs.telerik.com/fiddler/posts/13-08-19/faq---certificates-in-fiddler http://blogs.telerik.com/fiddler/posts/13-08-19/faq---certif... Relevant Quote: "Every Fiddler root certificate is uniquely generated, per user, per machine. No two Fiddler installations have the same root certificate. The only way for a Fiddler user to be “spoofed” by a bad guy is if that bad guy already is running code inside the user’s account (which means you’d already be pwned anyway)."

bri3d 12y ago
Every other product I can think of (Proxy.app, MITMproxy, and so on) also uses self-signed certificates generated at startup / configuration time rather than a shared root - I think that design is unique to Charles. Charles does allow you to use your own certificate, but it's not the default user flow. I see the ease-of-use case for the way Charles does it, but the shared-certificate approach is so insecure (you're basically handing the keys to all of your unpinned SSL traffic to anyone on the Internet) that I wish it would go away. I also really like Fiddler and the warnings it provides are excellent. Sadly, it doesn't really support OSX yet so many iOS developers can't use it.
- voltagex_ 12y ago
  A very awkward way of using Fiddler from OS X would be via a Windows VM that had Fiddler set up to allow connections from other machines.
- e28eta 12y ago
  I also found it hard to set up Charles to use a custom cert, definitely had to read the instructions on their site instead of trying to figure it out on my own.