This page explains how RelayGate uses HTTPS MITM and local CA files.
MITM means "man in the middle".
It describes a connection where one party sits between the browser and the real website.
In RelayGate, your browser connects to RelayGate locally. RelayGate then connects to the real website on your behalf.
Normal proxy tunnel mode can pass HTTPS traffic without reading it.
Some features need to see or modify HTTPS pages and resources. For those features, RelayGate can use HTTPS MITM.
Examples:
- document filtering
- page rules
- ad blocking on mutable documents
- resource replacement
- compatible User Script injection
- local debugging and inspection
MITM is not always good.
Malware can abuse MITM techniques to steal data, inject content, or spy on private traffic.
MITM can also be used by tools that the user allows, such as local security tools, debugging proxies, development tools, parental-control tools, and traffic inspection tools.
RelayGate uses MITM only to provide local features.
RelayGate is open source so users can inspect how it works. For safety, download RelayGate only from this repository, or build it yourself from source. Do not run RelayGate binaries from unknown third-party sources.
When HTTPS MITM is enabled, RelayGate creates local site certificates for your browser.
The browser must trust the RelayGate local CA. Without that trust, the browser may show certificate warnings or reject the connection.
RelayGate can generate a local CA for you.
On Windows, RelayGate can install this CA into the current user's Root certificate store. Browsers and apps that use the Windows trust store can then trust certificates generated by RelayGate.
Some browsers or apps use their own trust store and may need separate setup.
The CA private key stays on your machine.
RelayGate itself does not transmit or upload the CA private key.
The key is used locally so RelayGate can create certificates for the local browser connection when HTTPS MITM is enabled.
Do not share it with other people. Do not upload it. Do not publish it.
Anyone who has your CA private key can create certificates that may be trusted by your browser if your RelayGate CA is installed.
RelayGate can run without installing a CA.
Plain CONNECT tunnel mode does not need the RelayGate CA because RelayGate does not decrypt the HTTPS content in that mode.
RelayGate still checks the real target site's certificate by default on the upstream side.
Do not disable upstream certificate checks unless you understand the effect.