# Programatically determine if mitmproxy certificate has been installed

**URL:** <https://discourse.mitmproxy.org/t/programatically-determine-if-mitmproxy-certificate-has-been-installed/566>\
**Category:** Uncategorized\
**Created:** [July 28, 2017, 2:34am UTC](https://discourse.mitmproxy.org/t/programatically-determine-if-mitmproxy-certificate-has-been-installed/566 "2017-07-28T02:34:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![brannondorsey](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/brannondorsey/32/173_2.png) [@brannondorsey](https://discourse.mitmproxy.org/u/brannondorsey)\
**Post date:** [July 28, 2017, 2:34am UTC](https://discourse.mitmproxy.org/t/programatically-determine-if-mitmproxy-certificate-has-been-installed/566/1 "2017-07-28T02:34:30Z")

</div>

Hi all,

I’m looking for a way to determine if the mitmproxy certificate has been installed on a transparently proxied client from a mitmproxy script. As a somewhat unrelated follow up, is the certificate served by [http://mitm.it](http://mitm.it) locally from the machine that mitmproxy is running on? If so, where might I be able to find that html page on an Ubuntu install.

Thanks!  
Brannon

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [July 28, 2017, 11:32am UTC](https://discourse.mitmproxy.org/t/programatically-determine-if-mitmproxy-certificate-has-been-installed/566/2 "2017-07-28T11:32:36Z")

</div>

Hi,

> I’m looking for a way to determine if the mitmproxy certificate has been installed on a transparently proxied client from a mitmproxy script

The only heuristic you have is to see if the client accepts or rejects it. There is no way to know beforehand on the proxy.

> As a somewhat unrelated follow up, is the certificate served by [http://mitm.it](http://mitm.it) locally from the machine that mitmproxy is running on?

As stated on mitm.it, yes.

> If so, where might I be able to find that html page on an Ubuntu install.

[https://github.com/mitmproxy/mitmproxy/tree/2.0.x/mitmproxy/addons/onboardingapp/templates](https://github.com/mitmproxy/mitmproxy/tree/2.0.x/mitmproxy/addons/onboardingapp/templates)  
The certificates are stored in `~/.mitmproxy`.

Hope that helps!  
Max

---

<div class="post-metadata">

**Author:** ![brannondorsey](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/brannondorsey/32/173_2.png) [@brannondorsey](https://discourse.mitmproxy.org/u/brannondorsey)\
**Post date:** [July 28, 2017, 2:45pm UTC](https://discourse.mitmproxy.org/t/programatically-determine-if-mitmproxy-certificate-has-been-installed/566/3 "2017-07-28T14:45:44Z")

</div>

Hi Max,

Thanks for the reply! How exactly would one be able to tell if the certificate was accepted or rejected by the client without access to that machine (pentesting w/ transparent proxy + arpspoof)? I suppose that I could put some custom JavaScript on the [mitm.it](http://mitm.it) page that pools an arbitrary https:// url… If the request ever goes through than the cert was successfully installed? Is there a better way to do this?

Thanks!

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [July 28, 2017, 2:57pm UTC](https://discourse.mitmproxy.org/t/programatically-determine-if-mitmproxy-certificate-has-been-installed/566/4 "2017-07-28T14:57:42Z")

</div>

In short, no. See the [tls passthrough example](https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/tls_passthrough.py) in the repo on how to detect it on the proxy.

---

<div class="post-metadata">

**Author:** ![brannondorsey](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/brannondorsey/32/173_2.png) [@brannondorsey](https://discourse.mitmproxy.org/u/brannondorsey)\
**Post date:** [July 28, 2017, 3:27pm UTC](https://discourse.mitmproxy.org/t/programatically-determine-if-mitmproxy-certificate-has-been-installed/566/5 "2017-07-28T15:27:04Z")

</div>

I’m having a bit of trouble understanding the difference between [#1 and #2, and #3 and #4](https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/tls_passthrough.py#L9-L19). It seems to me that those pairs are both the same command.

It looks like the [`TlsFeedback` class](https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/tls_passthrough.py#L92-L107) might be what I’m looking for. Does that determine if the client can communicate with the mitmproxy server via TLS (and therefor the certificate has been installed) or if the client can communicate to the requested HOST (e.g. facebook) via TLS?