How to configure SSL certificates with Charles Web Proxy and the latest Android Emulator on Windows?

Question

I would like to use Charles web proxy to work with the Android emulator in Windows. I've successfully set up charles and have started the emulator with the command line:

emulator -http-proxy 127.0.0.1:8888 @NexusOne

I can see traffic coming from the android emulator in Charles, but the problem is that I'm developing against a live API which uses SSL and I'm not sure how to configure Charles to let me play about the the data which is sent and received. I'm aware of two areas where SSL is set up in Charles (Proxy -> Proxy Settings -> SSL and Proxy -> Client SSL Certificates) but I can't find any decent documentation which has let me do what I want to do. Has anyone experience with Charles, or certificates in general, who can explain how to achieve this. Maybe a primer on certificates would be good too, as I seem to be lacking knowledge as to why this is so difficult.

What is the emulator command? How do you use it? – Jacek Kwiecień Feb 07 '16 at 18:33 — Jacek Kwiecień, Feb 07 '16 at 18:33

score 76 · Answer 1 · edited Feb 19 '18 at 14:31

To remotely capture http or https traffic with charles you will need to do the following:

HOST - Machine running Charles and hosting the proxy CLIENT – User’s machine generating the traffic you will capture

Host Machine

Install fully licensed charles version
Proxy -> Proxy Settings -> check “Enable Transparent HTTP Proxying”
Proxy -> SSL Proxying Settings -> check “enable SSL Proxying”
Proxy -> SSL Proxying Settings -> click Add button and input * in both fields
Proxy -> Access Control Settings -> Add your local subnet (ex: 192.168.2.0/24) to authorize all machines on your local network to use the proxy from another machine
It might be advisable to set up the “auto save tool” in charles, this will auto save and rotate the charles logs.

Client Machine:

Install and permanently accept/trust the charles SSL certificate
http://www.charlesproxy.com/documentation/using-charles/ssl-certificates/
Configure IE, Firefox, and Chrome to use the socket charles is hosting the proxy on (ex: 192.168.1.100:8888)

When I tested this out I picked up two lines of a Facebook HTTPS chat (one was a line TO someone, and the other FROM)

you can also capture android emulator traffic this way if you start the emulator with:

emulator -avd <avd name> -http-proxy http://local_ip:8888/

Where LOCAL_IP is the IP address of your computer, not 127.0.0.1 as that is the IP address of the emulated phone.

Source: http://brakertech.com/capture-https-traffic-remotely-with-charles/

`Install and permanently accept/trust the charles SSL certificate` Um that's not safe, is it? I'd rather not let anyone pull a MITM on me. — Samuel Katz, Apr 21 '14 at 03:01
Found a solution for that: http://codeblog.shape.dk/blog/2014/01/06/custom-ssl-certificate-with-charles-web-proxy/ — Samuel Katz, Apr 21 '14 at 03:07
@fgysin the tab got it's own settings page. It can be opened via Proxy --> SSL Proxying Settings — Henning, Feb 19 '18 at 13:35
An update to what @SalmanAbbas wrote: it is actually no longer a security risk to permanently accept/trust the cert as Charles uniquely generates it. This means you can even trust the SSL root cert on live devices without much added risk. — Aron, Jul 13 '18 at 10:28

score 50 · Accepted Answer · edited Apr 20 '16 at 09:46

50

In Charles, go to Proxy>>Proxy Settings and select the SSL tab. Add your host to the list of Locations.

For example, if your secure call is going to https://secure.example.com, you can enter secure.example.com, or *.example.com.

Once the above is in place, you may need to right-click on the call in the main Charles window and select the SSL Proxying option.

Hope this helps.

edited Apr 20 '16 at 09:46

Stephan Muller

27,018
16
85
126

answered Nov 12 '10 at 01:55

bcj19

548
5
2

6

2017: Don't forget to install the Charles SSL certs: CharlesProxy.com/getssl – salonMonsters Feb 23 '17 at 22:34
2

@salonMonsters For some reason that site does not do anything on my android emulator...just says it would if the OS were configured to allow certs – TahoeWolverine Aug 09 '17 at 23:23
14

I don't see any SSL tab in Proxy Settings – Hlung Aug 17 '17 at 07:14
2

@Hlung You should see it directly under the Proxy menu as "SSL Proxying settings" – rurouniwallace Aug 29 '17 at 15:32
3

These instructions are old/incorrect. The correct way is "Proxy" > "SSL Proxy Settings...". Confirmed v4.2.7. macOS. Works with evaluation version. – Jonny Feb 28 '19 at 08:41

score 27 · Answer 3 · answered Mar 07 '14 at 21:45

For what it's worth here are the step by step instructions for doing this in an Android device. Should be the same for iOS:

Open Charles
Go to Proxy > Proxy Settings > SSL
Check “Enable SSL Proxying”
Select “Add location” and enter the host name and port (if needed)
Click ok and make sure the option is checked
Download the Charles cert from here: Charles cert >
Send that file to yourself in an email.
Open the email on your device and select the cert
In “Name the certificate” enter whatever you want
Click OK and you should get a message that the certificate was installed

You should then be able to see the SSL files in Charles. If you want to intercept and change the values you can use the "Map Local" tool which is really awesome:

In Charles go to Tools > Map Local
Select "Add entry"
Enter the values for the file you want to replace
In “Local path” select the file you want the app to load instead
Click OK
Make sure the entry is selected and click OK
Run your app
You should see in “Notes” that your file loads instead of the live one

Instead of emailing the cert to the device, I just visited http://charlesproxy.com/charles.crt in the browser on the device and it worked just fine. — gMale, Oct 22 '14 at 00:09
This is stale documentation, for an older version of Charles — Radu, Jun 17 '15 at 08:10
The older version of Charles can still be found though, here: http://charles.software.informer.com/download/ — Radu, Jun 17 '15 at 08:45

score 24 · Answer 4 · answered Feb 04 '16 at 12:16

Things have changed a little in the way Charles provides HTTPS proxying.

First the certificates installation options have been moved to the help menu.

Help -> SSL Proxying -> Install Charles Root Certificate
Help -> SSL Proxying -> Install Charles Root Certificate in iOS Simulators

Second, starting in iOS 9 you must provide a NSAppTransportSecurity option in your Info.plist and if you want Charles to work properly as a man in the middle, you must add:

<key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
<true/>

as part of the your domains see full example:

<key>NSExceptionDomains</key>
    <dict>
        <key>yourdomain.com</key>
        <dict>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSTemporaryExceptionMinimumTLSVersion</key>
            <string>TLSv1.1</string>
        </dict>

The reason being (I guess) that Charles at some point communicates in clear http after acting as the man in the middle https server.

Last step is to activate SSL Proxying for this domain in Charles (right click on domain and select Enable SSL Proxying)

score 7 · Answer 5 · answered Oct 15 '13 at 16:32

What worked for me - should really be moved to iPhone:

Charles

Enable transparent Http proxying
Enable SSL proxying
Right click on incoming request and select SSL proxying

Mac

Download Charles CA Certificate bundle http://www.charlesproxy.com/ssl.zip
Email yourself charles-proxy-ssl-proxying-certificate.crt

iPhone

Enable http proxy for Charles on port 8888
Select and install email attachment, yes trust it!

Voila, you can now view encrypted traffic from the domain added in the SSL proxying

score 7 · Answer 6 · answered Dec 03 '11 at 13:57

7

You should also click on "Install Charles CA SSL Certificates.." from the Charles Help menu. See more detailed instructions at http://blog.noodlewerk.com/general/tutorial-using-charles-proxy-to-debug-https-communication-between-server-and-ios-apps/

answered Dec 03 '11 at 13:57

Vineet Bhatia

2,469
4
30
28

score 2 · Answer 7 · answered Dec 01 '19 at 03:11

The certification installation step whatever mentioned here is correct https://stackoverflow.com/a/35200795/865220

But if you are having a pain of individually having to enable SSL Proxy for each and every new url like me, then to enable for all host names just enter * into the host and port names list in the SSL Proxying Settings like this:

score 0 · Answer 8 · answered Nov 13 '17 at 12:05

0

These things helped me

Go to proxy -> SSL proxy settings -> Add
Add your site name here and give port number as 8888

Right click on your site name on the left panel and choose "Enable SSL Proxying"

Hope this helps someone out there.

answered Nov 13 '17 at 12:05

iPhoneDeveloper

958
1
14
23

How to configure SSL certificates with Charles Web Proxy and the latest Android Emulator on Windows?

8 Answers8

Linked