diff options
| author | Maximilian Hils <git@maximilianhils.com> | 2015-11-07 11:30:28 -0800 |
|---|---|---|
| committer | Maximilian Hils <git@maximilianhils.com> | 2015-11-07 11:30:28 -0800 |
| commit | 9298325ca56780d183aa7a91b590909608d4d586 (patch) | |
| tree | d9559c4c6862459ccffc0e1815949983312d9aa8 | |
| parent | 58aeb2b843d47aad8e6b4a33f6b9ae46ffffcbfc (diff) | |
| parent | 96465075f4a56a811cee28ec3da7e5c994f4fa5e (diff) | |
| download | mitmproxy-9298325ca56780d183aa7a91b590909608d4d586.tar.gz mitmproxy-9298325ca56780d183aa7a91b590909608d4d586.tar.bz2 mitmproxy-9298325ca56780d183aa7a91b590909608d4d586.zip | |
Merge pull request #822 from ddworken/master
Added information on cert pinning (Fixes #689)
| -rw-r--r-- | docs/certinstall.rst | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/docs/certinstall.rst b/docs/certinstall.rst index 542c6dd2..2e041837 100644 --- a/docs/certinstall.rst +++ b/docs/certinstall.rst @@ -105,6 +105,16 @@ configure your testing system or browser to trust the mitmproxy CA as a signing root authority. For security reasons, the mitmproxy CA is generated uniquely on the first start and is not shared between mitmproxy installations on different devices. +Some applications pin their SSL certificates in order to prevent MITM attacks. +This means that **mitmproxy** and **mitmdump's** certificates will not be +accepted by these applications. This is because when an application pins a +certificate it requires that SSL traffic is encrypted with a specific +certificate rather than any certificate that is signed by a trusted Certificate +Authority (CA). In order to work around this, it is recommended to use the +`Ignore Domains <http://docs.mitmproxy.org/en/stable/features/passthrough.html#ignore-domains>`_ +feature in order to prevent **mitmproxy** and **mitmdump** from intercepting +traffic to these specific domains. + CA and cert files ----------------- |