Skip to content
Casazium
Casazium

Trusting the certificate ​

To show HTTPS traffic, Wirescry decrypts it with a certificate authority (CA) it created for your install on first launch. A program shows its HTTPS traffic in Wirescry only if it trusts that CA.

When you need to ​

Most of the time, you don't:

  • Browsers Wirescry opens already trust it: Chrome-family browsers through a setting for that profile alone, Firefox after its one-time step.
  • Terminals Wirescry opens, or set up with one line, point their tools at a bundle of Wirescry's CA plus the usual public roots.

You need to trust it system-wide only for programs Wirescry doesn't set up: desktop apps, other browsers, and tools that read only the system certificate store, such as Go on Windows. Setup → Manual setup → How to trust the certificate on this computer shows the commands below with your file's path filled in.

WARNING

Anything that trusts this certificate accepts traffic Wirescry intercepts. Its private key stays on your computer, but remove the certificate when you no longer need it.

The certificate is the file ca.pem in Wirescry's data folder. It is named "Wirescry CA" followed by a code; Setup → Certificate shows yours, with its expiry date and fingerprint.

macOS ​

Run this in Terminal; macOS asks for your password to confirm.

bash
security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db ~/Library/Application\ Support/Wirescry/ca.pem

Or double-click the saved certificate, open it in Keychain Access, and under Trust set When using this certificate to Always Trust.

To remove it, delete the "Wirescry CA" certificate from the login keychain in Keychain Access.

Windows ​

Run this in PowerShell or Command Prompt; Windows asks you to confirm.

powershell
certutil -user -addstore Root "$env:APPDATA\Wirescry\ca.pem"

In Command Prompt, write the path as "%APPDATA%\Wirescry\ca.pem". This trusts the certificate for your Windows account only. To remove it, use the certificate's name as shown in Setup → Certificate:

powershell
certutil -user -delstore Root "Wirescry CA (1a2b3c4d)"

Firefox keeps its own list: in its settings, open Certificates → View Certificates → Authorities and import the saved file.

Linux ​

Debian and Ubuntu:

bash
sudo cp ~/.config/Wirescry/ca.pem /usr/local/share/ca-certificates/wirescry.crt && sudo update-ca-certificates

Fedora, Arch and others with p11-kit:

bash
sudo trust anchor ~/.config/Wirescry/ca.pem

Chrome and Firefox keep their own lists. For Chrome, with certutil from libnss3-tools (Debian, Ubuntu) or nss-tools (Fedora), using your certificate's name:

bash
certutil -d sql:$HOME/.pki/nssdb -A -t C,, -n "Wirescry CA (1a2b3c4d)" -i ~/.config/Wirescry/ca.pem

For Firefox, import the saved file under Certificates → View Certificates → Authorities in its settings.

To remove it: on Debian and Ubuntu, delete /usr/local/share/ca-certificates/wirescry.crt and run sudo update-ca-certificates --fresh; with p11-kit, run sudo trust anchor --remove with the same file; for Chrome, run certutil -d sql:$HOME/.pki/nssdb -D -n with the certificate's name.

Reset certificate ​

Setup → Certificate → Reset certificate… replaces the CA with a new one, with a new name. Use it if you think the old one's key was exposed, or just to start over. It:

  • creates the new certificate and points the terminal setup at it,
  • deletes Wirescry's Firefox profile, so Firefox asks you to trust the new certificate on its next launch (and its sign-ins are gone),
  • restarts the proxy on the same port.

Relaunch any browsers you opened. Anything you set up by hand trusts only the old certificate, so set it up again, and remove the old one from your system: it is no longer used, but stays trusted until you do.