0

I'm using http toolkit on Linux , When I'm trying to intercept the traffic i get the following message:

The upstream server has an untrusted HTTPS certificate, so HTTP Toolkit did not forward the request.

By default unrecognized certificate authorities (CAs) are only accepted for localhost servers, but additional CAs can be trusted from the Settings page.

now i know that i have to import certificate for the server to accept , i created a pfx certificate on the device then imported it ,but no luck ? am i missing anything ?

any help would be appreciated .

Regards

1 Answer 1

0

To trust a certificate for upstream connections, you need to add the CA certificate to the 'Trusted CA Certificates' section on HTTP Toolkit's Settings page (note that this requires HTTP Toolkit Pro), here:

The Trusted CA Certificates settings UI

A PFX file is a slightly unusual format for this which suggests maybe you've loaded this as a client certificate instead? That won't work. It would normally be a .pem file containing content like:

-----BEGIN CERTIFICATE-----
ABCDEF[...]
-----END CERTIFICATE-----

There's many ways to get the CA certificate like this to load it, but probably the easiest is to visit the domain you're having trouble with in your web browser, then click the padlock, select the issuing CA certificate (the certificate authority/issuer 'parent' certificate, not the website certificate) and save that.

4
  • First of all thanks for your reply , i could export the certificate issuer certificate to crt now i need to convert it to pfx for http toolkit , the problem is to do that i need the Private Key File , how to get that ? i could also extracted a BKS cert from the app itself , but have no clue how to convert it to pfx . any tips for those two cases would be appreciated .
    – sam
    Commented Jul 25 at 15:36
  • @sam you do not need the private key and you do not need a PFX file, a CRT is perfect by itself. You must be looking at the wrong option in the settings. PFX & private key is used as configuration for a client certificate (where the client authenticates itself to the server) which is different from what's required to trust a server's certificate (which is just the public certificate for their CA - no private keys).
    – Tim Perry
    Commented Jul 27 at 12:12
  • i added the certificate at "'Trusted CA Certificates' section" in http toolkit pro , but still no luck . and further suggestions will be appreciated mate. anyway thanks a lot for your help .
    – sam
    Commented Jul 28 at 7:43
  • If you've added it to that section, and you're still seeing the untrusted certificate error, then you haven't added the correct CA certificate for that failing connection. The other thing you could do (both should work though!) is that you can add the failing host to the 'Host HTTPS Whitelist' in the settings, which will skip validation entirely for that hostname. Trusting the CA is more secure, but that can be useful for a quick fix.
    – Tim Perry
    Commented Jul 29 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.