Skip to content
TonyProxy Docs

HTTPS Certificate Setup

TonyProxy decrypts HTTPS the same way any MITM proxy inspector does: it generates its own root CA certificate and re-signs traffic on the fly. For that to work without browser/OS warnings, the CA has to be installed and explicitly trusted.

Why “per-instance”

Every install of TonyProxy (Dev/Sandbox/Production, each a separate build) generates its own CA — never shares one across environments or machines. This means:

  • Reinstalling or switching environments means re-trusting a new CA
  • No two TonyProxy instances can decrypt each other’s captured traffic
  • Revoking trust is as simple as removing that one cert from Keychain

Install on this Mac

  1. Go to Settings → Certificate.
  2. Click Install. This generates the CA (if not already present) and adds it to the login Keychain.
  3. macOS still requires explicit trust for a locally-generated root CA — open Keychain Access, find “TonyProxy CA”, double-click it, expand Trust, and set When using this certificate to Always Trust.

Without step 3, TonyProxy still runs, but every HTTPS site will show a certificate-warning to any client that validates certs strictly.

Install on another device

Use the Connect Device button (QR icon) in the toolbar — it serves the CA cert over your LAN and walks you through the OS-specific trust step:

  • iOS: scan the QR code → installs a profile → then go to Settings → General → About → Certificate Trust Settings and enable full trust for TonyProxy CA.
  • Android: scan or open the URL → install as a user CA → some apps (those using certificate pinning) still won’t decrypt; see Debugging an Android App.
  • macOS/other Macs: same URL works in Safari, then trust it in Keychain Access as above.

Troubleshooting

See Certificate Problems if requests still fail after installing.