Certificate Installation
To show the contents of HTTPS traffic, the app has to decrypt it on your computer. It uses its own root CA certificate for that. Each installation generates its own certificate; it is never shared between machines.
Without it, HTTPS requests still appear in the captured traffic, but stay encrypted.
What has to end up true
The certificate must be in your system's trusted root store and marked as trusted for SSL. The wizard under the SSL Certificate menu does both, and verifies the result; it needs administrator privileges, so expect a password prompt or a system security dialog.
On Linux the privileges are obtained through pkexec or a graphical sudo helper (zenity, kdialog, yad). If none of them is available, the installation cannot proceed.
Where the certificate ends up:
| Platform | Location |
|---|---|
| macOS | login keychain, trusted for SSL |
| Windows | Trusted Root Certification Authorities |
| Debian/Ubuntu | /usr/local/share/ca-certificates/solpuga-proxy-ca.crt |
| Arch | /etc/ca-certificates/trust-source/anchors/solpuga-proxy-ca.crt |
| RHEL/Fedora | /etc/pki/ca-trust/source/anchors/solpuga-proxy-ca.crt |
| openSUSE | /etc/pki/trust/anchors/solpuga-proxy-ca.crt |
Firefox keeps its own certificate store and does not read the system one. Import the certificate there separately, through its privacy and security settings.
If the automatic installation does not work
The wizard can also hand you the certificate file and the exact commands or dialog sequence for your platform, then re-check the result. In short, what you are doing by hand is:
- macOS — add the certificate to a keychain and grant it
trustRoottrust for SSL. - Windows — place it in Trusted Root Certification Authorities for the local machine.
- Linux — copy it into the distribution's CA anchor directory and refresh the trust store (
update-ca-certificatesorupdate-ca-trust extract).
A certificate that is installed but not yet trusted makes verification fail — that is the step to repeat, not the installation.
Browser still refusing it after that? See ERR_CERT_AUTHORITY_INVALID through a proxy.
Exporting the certificate
The installed certificate can be exported in PEM format from Settings → Proxy.
Use that copy where the app cannot install it itself — a container, a CI runner, or a device you set up by hand.
Removing the certificate
The certificate can be removed from Settings → Proxy, or from the certificate wizard. Removing it does not remove the app and does not delete captured traffic.
On macOS, a certificate that was moved into the System keychain by hand has to be removed through Keychain Access. On Linux, when the removal cannot be performed directly, the app opens a terminal with the commands to run.
Services that refuse the certificate
Some apps and services use certificate pinning and will not accept any proxy CA. They typically stop connecting while capture is on.
Add such a host to the bypass list (see Settings) and it is tunnelled through without decryption: it keeps working, and its traffic is still recorded, just not readable.
Mobile devices
Simulators, emulators, and physical phones need the certificate installed and trusted on the device as well — see Mobile Devices.