# Capture HTTPS Traffic without decryption of SSL connection

**URL:** <https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880>\
**Category:** Uncategorized\
**Created:** [March 2, 2018, 4:42am UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880 "2018-03-02T04:42:00Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![csgaur](https://avatars.discourse-cdn.com/v4/letter/c/74df32/32.png) [@csgaur](https://discourse.mitmproxy.org/u/csgaur)\
**Post date:** [March 2, 2018, 4:42am UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/1 "2018-03-02T04:42:00Z")

</div>

Hi,  
I have setup mitmproxy in transparent mode with all HTTP/HTTPS traffic routed to my proxy through firewall. I want to see HTTPS requests without decrypting it as I do not have any requisite certificates for domains.

Is there any command line option to mitmproxy to make pass through settings to see what HTTPS requests being made from connected clients. just HTTP/HTTPS requests without any decryption.

Thanks  
Chandra

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [March 2, 2018, 8:24pm UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/2 "2018-03-02T20:24:34Z")

</div>

> [@csgaur](#):
>
> I want to see HTTPS requests without decrypting it

Mitmproxy cannot view the contents of TLS-protected sessions without performing a man-in-the-middle attack. If we could, that’d be a major security vulnerability in TLS.

---

<div class="post-metadata">

**Author:** ![csgaur](https://avatars.discourse-cdn.com/v4/letter/c/74df32/32.png) [@csgaur](https://discourse.mitmproxy.org/u/csgaur)\
**Post date:** [March 6, 2018, 6:14am UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/3 "2018-03-06T06:14:07Z")

</div>

Thanks Max!  
Can’t we even sees the HTTPS requests (whole URLs) being made by connected clients?

Thanks  
Chandra

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [March 6, 2018, 9:40am UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/4 "2018-03-06T09:40:25Z")

</div>

No, all data – including the URL – is protected by TLS.

---

<div class="post-metadata">

**Author:** ![csgaur](https://avatars.discourse-cdn.com/v4/letter/c/74df32/32.png) [@csgaur](https://discourse.mitmproxy.org/u/csgaur)\
**Post date:** [March 7, 2018, 3:10am UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/5 "2018-03-07T03:10:27Z")

</div>

Thanks Max for details.

---

<div class="post-metadata">

**Author:** ![ericj1977](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/ericj1977/32/300_2.png) [@ericj1977](https://discourse.mitmproxy.org/u/ericj1977)\
**Post date:** [April 24, 2018, 8:51am UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/6 "2018-04-24T08:51:10Z")

</div>

then how sonicwall is doing this job without installing SSL certificate in the browser?

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [April 25, 2018, 2:20pm UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/7 "2018-04-25T14:20:40Z")

</div>

I don’t know what sonicwall is doing, but one alternative would be to e.g. do IP-based filtering, as metadata is unprotected.

---

<div class="post-metadata">

**Author:** ![Anton](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Anton](https://discourse.mitmproxy.org/u/Anton)\
**Post date:** [April 27, 2018, 11:45am UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/8 "2018-04-27T11:45:46Z")

</div>

Appliances like Sonicwall that do SSL inspection essentially break the SSL tunnel between the browser and the end site and form 2 tunnels:  
Browser \<=\> SSL Inspection Module \<=\> Website

So the SSL inspector (if its configured to do so) creates a session between the browser and its self, then creates a session between its self and the website, so everything is visible to it, but still ‘encrypted’. But your browsers session is with the SSL inspector, not the website.

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [May 16, 2018, 12:48pm UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/9 "2018-05-16T12:48:22Z")

</div>

> [@Anton](#):
>
> So the SSL inspector (if its configured to do so) creates a session between the browser and its self, then creates a session between its self and the website, so everything is visible to it, but still ‘encrypted’. But your browsers session is with the SSL inspector, not the website.

This is also how mitmproxy works, and this requires you to install a certificate on the client (in contrast to what @ericj1977 said).

---

<div class="post-metadata">

**Author:** ![ybaturina](https://avatars.discourse-cdn.com/v4/letter/y/e47774/32.png) [@ybaturina](https://discourse.mitmproxy.org/u/ybaturina)\
**Post date:** [October 3, 2018, 3:33pm UTC](https://discourse.mitmproxy.org/t/capture-https-traffic-without-decryption-of-ssl-connection/880/10 "2018-10-03T15:33:07Z")

</div>

Hi, I have a question regarding usage of MITM proxy with BrowserStack infrastructure.

We test mobile applications, and for automation purposes we decided to use MITM proxy and BrowserStack. Browserstack doesn’t allow to install the certificates on the devices, so MITM proxy won’t intercept HTTPS requests. There is a script which is downloaded using secured connection as soon as our mobile test app is opened. MITM ignores this request, so we can’t use this mobile application at all.

As @mhils says that MITM can’t track HTTPS requests without certificate being installed on the devices, does it mean that MITM can’t be used in BrowserStack infrastructure in our case?

Thank you in advance for the answer.