Skip to content

Latest commit

 

History

History
92 lines (58 loc) · 2.68 KB

File metadata and controls

92 lines (58 loc) · 2.68 KB

HTTPS MITM And CA

This page explains how RelayGate uses HTTPS MITM and local CA files.

What MITM Means

MITM means "man in the middle".

It describes a connection where one party sits between the browser and the real website.

In RelayGate, your browser connects to RelayGate locally. RelayGate then connects to the real website on your behalf.

Why RelayGate Uses MITM

Normal proxy tunnel mode can pass HTTPS traffic without reading it.

Some features need to see or modify HTTPS pages and resources. For those features, RelayGate can use HTTPS MITM.

Examples:

  • document filtering
  • page rules
  • ad blocking on mutable documents
  • resource replacement
  • compatible User Script injection
  • local debugging and inspection

MITM Is Powerful

MITM is not always good.

Malware can abuse MITM techniques to steal data, inject content, or spy on private traffic.

MITM can also be used by tools that the user allows, such as local security tools, debugging proxies, development tools, parental-control tools, and traffic inspection tools.

RelayGate uses MITM only to provide local features.

RelayGate is open source so users can inspect how it works. For safety, download RelayGate only from this repository, or build it yourself from source. Do not run RelayGate binaries from unknown third-party sources.

Why A Local CA Is Needed

When HTTPS MITM is enabled, RelayGate creates local site certificates for your browser.

The browser must trust the RelayGate local CA. Without that trust, the browser may show certificate warnings or reject the connection.

RelayGate can generate a local CA for you.

On Windows, RelayGate can install this CA into the current user's Root certificate store. Browsers and apps that use the Windows trust store can then trust certificates generated by RelayGate.

Some browsers or apps use their own trust store and may need separate setup.

CA Private Key Safety

The CA private key stays on your machine.

RelayGate itself does not transmit or upload the CA private key.

The key is used locally so RelayGate can create certificates for the local browser connection when HTTPS MITM is enabled.

Do not share it with other people. Do not upload it. Do not publish it.

Anyone who has your CA private key can create certificates that may be trusted by your browser if your RelayGate CA is installed.

Plain Tunnel Mode

RelayGate can run without installing a CA.

Plain CONNECT tunnel mode does not need the RelayGate CA because RelayGate does not decrypt the HTTPS content in that mode.

Upstream Certificate Checks

RelayGate still checks the real target site's certificate by default on the upstream side.

Do not disable upstream certificate checks unless you understand the effect.