From f3558f18ecabba983aba001468b06394471e6d8b Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Fri, 5 Jun 2026 23:30:00 +0200 Subject: Serve the CA certificate for browsers/mobile at http://mitmux.cert/ Browser/mobile setup previously meant "find ca.pem on disk and import it manually" - awkward on a phone or tablet especially, which has no convenient way to get a file onto the device at all short of emailing it to yourself or similar. Any client already configured to proxy through mitmux can now just visit http://mitmux.cert/ and get the cert directly, with Content-Type: application/x-x509-ca-cert triggering iOS/Android's native "install this certificate" prompt. Same idea as mitmproxy's own http://mitm.it/, arrived at independently rather than reusing their domain - mitmux.cert isn't a registered TLD, so it can never collide with a real site someone meant to visit. Deliberately HTTP-only: fetching it over HTTPS would require the client to already trust mitmux's CA to MITM that very connection, the exact chicken-and-egg problem this exists to solve, so it's not attempted on the CONNECT/TLS path at all. internal/proxy/proxy.go: isCertDownloadHost matches the hostname case-insensitively regardless of port; handleHTTP checks it before ever dialing upstream and answers directly via serveCACert, using the CA's own CertPEM bytes already held in memory. Short-circuits before record() is ever reached, so the download itself never pollutes history. Verified live: fetched http://mitmux.cert/ through a real running proxy and confirmed the downloaded bytes are byte-identical to the actual ca.pem on disk (diff, not just "the request succeeded"); confirmed a request with an explicit port and a path still matches; confirmed normal proxying to an unrelated host is completely unaffected; confirmed via direct SQLite query that the cert-download requests never appear in history while a normal request in the same session does. Also documented (no code needed): any standard proxy-switcher extension (FoxyProxy, etc.) or a phone/tablet's own Wi-Fi proxy setting already works with mitmux exactly like it would with Burp/ZAP/Caido, since it's a normal forward proxy speaking the standard protocol. This was true before but never actually spelled out in the README for the phone/ tablet case specifically, which is a real, common daily workflow. go build/vet/gofmt/test/mod tidy all clean. --- README.md | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) (limited to 'README.md') diff --git a/README.md b/README.md index 393b0bc..dfa9f87 100644 --- a/README.md +++ b/README.md @@ -144,13 +144,33 @@ shorter `-socket /tmp/mitmux.sock` (and the matching `-socket` to trust store itself. Installing a root CA is a system-wide trust change, so you run the printed command yourself. + For a phone, tablet, or any other device where copying a file over + and importing it manually is awkward - the actual common case for + mobile testing - point the device's browser at + **`http://mitmux.cert/`** once it's configured to proxy through + mitmux (step 3). mitmuxd recognizes that hostname specifically and + serves its own CA certificate as a download, the same trick + [mitmproxy's `mitm.it`](https://mitm.it) uses: no DNS lookup, no + real domain, works the moment traffic is flowing through the proxy + at all - the browser's install-certificate prompt handles the rest. + Plain `http://`, not `https://`: fetching it over TLS would need the + device to already trust mitmux's CA to intercept that very + connection, which is the exact problem this page solves. + 3. **Point a client at the proxy.** e.g.: ```sh curl -x http://127.0.0.1:8080 --cacert ~/.config/mitmux/ca.pem https://example.com/ ``` - Or configure your browser's proxy settings to `127.0.0.1:8080`. + Or configure your browser's proxy settings to `127.0.0.1:8080` - + directly, or via a proxy-switcher extension like + [FoxyProxy](https://getfoxyproxy.org/): add a new proxy profile + pointing at `127.0.0.1:8080` (HTTP, and reused for HTTPS - mitmux + handles both on the same listener), no mitmux-specific setup needed + since it's a standard forward proxy speaking the same protocol Burp/ + ZAP/Caido all do. Same story for a phone or tablet: set its Wi-Fi + proxy to your machine's LAN address and the daemon's port. 4. **Open the TUI** (in another terminal - the daemon keeps running independently): -- cgit v1.2.3