How can I install Fiddler ca-certificate on Ubuntu to decrypt HTTPS?
3
votes
1
answer
3561
views
I am trying to get my Ubuntu machine to properly recognize and use the certificate from Fiddler as a trusted source so I can decryt HTTPS traffic (specifically to google-analytics). I had this working once before, but had to since reinstall Ubuntu and now have to re-setup Fiddler. I can't remember what I did in the first place and I've spent the better part of today trying to figure it out.
I think I am inching closer to getting this certificate to recognize. By that I mean that when I went to Google a few hours ago, while using Fiddler, I would see the 'Connection Not Secure message' - which I think means Google is just actively refusing to recognize Fiddler's certificate. Now, I am getting a This Site Can't Be Reached page (ERR_SOCKET_NOT_CONNECTED) page.
I have tried a number of different things today to try to get this to work, but this is what I did with my last attempt:
Used THIS SITE as a jumping off point to get Fiddler installed.
- Installed mono 4.8.0
- Did not run the '/usr/lib/mono//mozroots --import --sync' command from the Linux setup page since when I tried I got a message in Terminal saying that mozroots is depreciated and to use client_sync instead. (client_sync seems to just update the mono cert store with whatever CRT file you pass to it.
- Installed Fiddler (Left it as default as I could - using 8888 as listing port)
- Ticked the 'Decrpyt HTTPS' box in Fiddler
- Exported the Fiddler certificate to the desktop
- Converted the CER cert file to PEM format (CRT specifically) with openssl (update-ca-certificates on ubuntu needs a PEM formatted cert file and the CER file Fiddler exports is in a binary format.)
- Copied the CRT file to /usr/share/ca-certificates/
- From terminal ran 'sudo dpkg-reconfigure ca-certificates' (Clicked 'Ask' then 'OK') (this re configures ca-certificates, runs update-ca-certificate, and updates mono cert store (by running client_sync from mono and passes it the updated ca-certificates.crt file that this process creates). This places a PEM version of the Fiddler CRT file into /etc/ssl/ca-certificates/ and packages it into the bigger ca-certificates.conf file.
This is pretty much where I am at right now. Turning Fiddler off - I can get to Google just fine, turning it on gives me the page I mentioned at the top of this post. I can see all other HTTP requests as expected.
When I got this to work last time, I was reading a lot of suggestions of the web for how to get a CA certificate installed on Ubuntu and tried to pick that trail up again, but everything I read has since blended together. I do vaguely remember importing the Fiddler cert file into Firefox as a Person, exporting that cert, then importing the file I just exported back into FF as a CA trusted root, then deleted the person cert that I installed in the first place. I think I them used the cert exported from FF to import to the system with 'update-ca-certificates'. I have no idea if this was a critical step or not.
I was also playing around with mitmproxy at the same time which also needed a proxy - again, no idea if that helped the process at all.
I am basically throwing things at a wall right now and seeing what sticks.
Asked by Ryan
(31 rep)
Mar 25, 2017, 01:46 AM
Last activity: Jun 14, 2025, 08:08 AM
Last activity: Jun 14, 2025, 08:08 AM