# Mitmproxy ca-certificate uniqueness and dependencies

**URL:** <https://discourse.mitmproxy.org/t/mitmproxy-ca-certificate-uniqueness-and-dependencies/756>\
**Category:** Uncategorized\
**Created:** [December 7, 2017, 6:56pm UTC](https://discourse.mitmproxy.org/t/mitmproxy-ca-certificate-uniqueness-and-dependencies/756 "2017-12-07T18:56:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karu](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/karu/32/234_2.png) [@Karu](https://discourse.mitmproxy.org/u/Karu)\
**Post date:** [December 7, 2017, 6:56pm UTC](https://discourse.mitmproxy.org/t/mitmproxy-ca-certificate-uniqueness-and-dependencies/756/1 "2017-12-07T18:56:06Z")

</div>

I know that when mitmproxy is first runned it created ~/.mitmproxy directory with certificates. My question is that how unique or what information the mitmproxy-ca-cert.cer file is containing.

I have managed to create docker container with mitmproxy to test some aplication in other containers. I want to know if I can include the mitmproxy-ca-cert.cer file to directory where docker-compose is located or should the mitmproxy container create every time a new certificate?

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [December 9, 2017, 8:50pm UTC](https://discourse.mitmproxy.org/t/mitmproxy-ca-certificate-uniqueness-and-dependencies/756/2 "2017-12-09T20:50:52Z")

</div>

Good question!

On mitmproxy’s first run, mitmproxy will create a unique Root Certificate Authority on your device and store the associated certificate and private key in `~/.mitmproxy`. Anyone with access to the private key can perform man-in-the-middle attacks on anyone who trusts this mitmproxy CA. As such, you should be very careful when sharing mitmproxy’s private CA key.

Note that the paragraph above concerns the _private_ key for the CA certificate. The `-cert.*` files only contain the _public_ key (you can verify this yourself by comparing `mitmproxy-ca.pem` and `mitmproxy-ca-cert.pem` in a text editor). There are generally no issues with distributing the public key, just make sure that your private key stays private.