2 files changed, 63 insertions, 0 deletions
diff --git a/internal/proxy/certdownload_test.go b/internal/proxy/certdownload_test.go
new file mode 100644
index 0000000..aae5f48
--- /dev/null
+++ b/internal/proxy/certdownload_test.go
@@ -0,0 +1,24 @@
+package proxy
+
+import "testing"
+
+func TestIsCertDownloadHost(t *testing.T) {
+	tests := []struct {
+		host string
+		want bool
+	}{
+		{"mitmux.cert", true},
+		{"mitmux.cert:80", true},
+		{"MITMUX.CERT", true},
+		{"Mitmux.Cert:8080", true},
+		{"example.com", false},
+		{"notmitmux.cert", false},
+		{"mitmux.cert.evil.com", false},
+		{"", false},
+	}
+	for _, tt := range tests {
+		if got := isCertDownloadHost(tt.host); got != tt.want {
+			t.Errorf("isCertDownloadHost(%q) = %v, want %v", tt.host, got, tt.want)
+		}
+	}
+}
diff --git a/internal/proxy/proxy.go b/internal/proxy/proxy.go
index 2e80ed2..523ca01 100644
--- a/internal/proxy/proxy.go
+++ b/internal/proxy/proxy.go
@@ -31,6 +31,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"strings"
 	"sync"
 	"time"
 
@@ -611,6 +612,10 @@ func (s *Server) handleHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "mitmux: request must use absolute-form URI (configure as a proxy, not a target)", http.StatusBadRequest)
 		return
 	}
+	if isCertDownloadHost(r.URL.Host) {
+		s.serveCACert(w)
+		return
+	}
 	host := r.URL.Host
 	dial := func(ctx context.Context) (net.Conn, string, error) {
 		return dialUpstreamPlain(ctx, host, s.UpstreamProxy)
@@ -618,6 +623,40 @@ func (s *Server) handleHTTP(w http.ResponseWriter, r *http.Request) {
 	s.forward(dial, r.URL.Scheme, r.URL.Host, w, r)
 }
 
+// certDownloadHost is a magic hostname mitmux intercepts and answers
+// itself, serving its own CA certificate - reachable over plain HTTP
+// from any client configured to use mitmux as its proxy, including a
+// mobile browser, which otherwise has no easy way to get a file onto
+// the device to trust as a CA at all. Deliberately not a real,
+// resolvable domain (".cert" isn't a registered TLD) so it can never
+// collide with an actual site someone meant to visit - the same idea
+// as mitmproxy's own http://mitm.it/, arrived at independently rather
+// than reusing their domain. HTTP only, on purpose: fetching this over
+// HTTPS would require the client to already trust mitmux's CA to MITM
+// that very connection - exactly the chicken-and-egg problem this page
+// exists to solve, so intercepting it on the CONNECT/TLS path wouldn't
+// make sense and isn't attempted.
+const certDownloadHost = "mitmux.cert"
+
+func isCertDownloadHost(hostPort string) bool {
+	host := hostPort
+	if h, _, err := net.SplitHostPort(hostPort); err == nil {
+		host = h
+	}
+	return strings.EqualFold(host, certDownloadHost)
+}
+
+// serveCACert answers with the CA certificate as a download. The
+// content type (application/x-x509-ca-cert) is what makes iOS and
+// Android offer to install it as a trusted certificate directly from
+// the browser's download prompt, rather than just saving a plain file.
+func (s *Server) serveCACert(w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "application/x-x509-ca-cert")
+	w.Header().Set("Content-Disposition", `attachment; filename="mitmux-ca.pem"`)
+	w.WriteHeader(http.StatusOK)
+	w.Write(s.ca.CertPEM)
+}
+
 func stripHopByHop(h http.Header) {
 	for _, k := range hopByHopHeaders {
 		h.Del(k)