diff options
| author | Rouli <rouli.net@gmail.com> | 2013-01-17 17:33:29 +0200 |
|---|---|---|
| committer | Rouli <rouli.net@gmail.com> | 2013-01-17 17:33:29 +0200 |
| commit | 446f9f0a0fc12159ba663d3b8bdc8f1206a197c7 (patch) | |
| tree | 9cb474c3154fb4146cce41e40e25b4a8e3e57d46 /doc-src/features/upstreamcerts.html | |
| parent | 20fa6a30839500207d7d509fe3b8697dbd22a33e (diff) | |
| parent | 280dd94198931bcd819848a70d68f6f5d9f3270b (diff) | |
| download | mitmproxy-446f9f0a0fc12159ba663d3b8bdc8f1206a197c7.tar.gz mitmproxy-446f9f0a0fc12159ba663d3b8bdc8f1206a197c7.tar.bz2 mitmproxy-446f9f0a0fc12159ba663d3b8bdc8f1206a197c7.zip | |
Merge remote-tracking branch 'upstream/master'
Diffstat (limited to 'doc-src/features/upstreamcerts.html')
| -rw-r--r-- | doc-src/features/upstreamcerts.html | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/doc-src/features/upstreamcerts.html b/doc-src/features/upstreamcerts.html new file mode 100644 index 00000000..8de75ee3 --- /dev/null +++ b/doc-src/features/upstreamcerts.html @@ -0,0 +1,21 @@ +When mitmproxy receives a connection destined for an SSL-protected service, it +freezes the connection before reading its request data, and makes a connection +to the upstream server to "sniff" the contents of its SSL certificate. The +information gained - the __Common Name__ and __Subject Alternative Names__ - is +then used to generate the interception certificate, which is sent to the client +so the connection can continue. + +This rather intricate little dance lets us seamlessly generate correct +certificates even if the client has specifed only an IP address rather than the +hostname. It also means that we don't need to sniff additional data to generate +certs in transparent mode. + +Upstream cert sniffing is on by default, and can optionally be turned off. + +<table class="table"> + <tbody> + <tr> + <th width="20%">command-line</th> <td>--no-upstream-cert</td> + </tr> + </tbody> +</table> |