Trust the ReqRes certificate

HTTPS is encrypted between an app and its server. To show you the requests and responses inside it, ReqRes needs your Mac to trust its certificate authority, "ReqRes CA", which ReqRes creates on your Mac the first time it runs.

Why HTTPS needs a certificate#

ReqRes reads HTTPS by sitting between the app and the server. It decrypts the traffic, then encrypts it again with a certificate for that website, signed by the ReqRes CA. An app accepts that certificate only if your Mac trusts the ReqRes CA.

Plain HTTP needs no certificate. It is readable as soon as capture runs.

Install and trust the certificate#

1. Open Settings ▸ Certificate. The menu item Certificate ▸ Install CA Certificate... opens the same pane.
2. Under ReqRes CA, click Install CA certificate. The Keychain row changes to "Installed".
3. Click Trust. macOS asks for your password. The Trust row changes to "Trusted".

The section also shows the certificate's SHA-256 fingerprint and a line that says what capture does with HTTPS right now. Certificate Details… opens the certificate in the standard macOS certificate viewer.

You do not need to restart capture. Once the certificate is trusted, ReqRes decrypts new HTTPS connections at once. A connection that was already open stays relayed until the app that opened it reconnects. To decrypt it now, quit and reopen that app.

What you see until it is trusted#

• Each relayed connection is one row, written when the connection closes. The Code column shows a crossed-out lock, and the row shows the host and port, "not decrypted" and the bytes sent each way. A connection can stay open for minutes, so its row can arrive late.
• Selecting the row shows why it was not decrypted and where the connection went: Endpoint, Protocol, Server, Sent, Received, Opened, Closed and Open for. There are no requests, headers or bodies. Open Certificate Settings… opens Settings ▸ Certificate.
• Opening a relayed row never uses one of the free version's HTTPS inspections.

Some connections are never decrypted, even after you trust the certificate:

• Hosts that macOS pins for its own services, such as iCloud and Software Update. Their rows read "SSL pinned by macOS", followed by the service.
• Apps that refused ReqRes's certificate once, such as WhatsApp for its media. Their rows read "SSL pinned by" and the app's name. See Keep SSL-pinned apps working.
• Hosts you list under Settings ▸ Capture ▸ Excluded from interception. ReqRes passes them through untouched and does not record them. See Pass a host through untouched.

If HTTPS stays unreadable after you trust the certificate, see Fix HTTPS and certificate errors.

What the certificate is#

• It is different on every Mac.
• Install CA certificate adds it to your login keychain. Trust marks it as trusted in your user account, for two things only: secure website connections (SSL) and basic certificate checks (X.509). It cannot create another certificate authority below it.
• It has an RSA 2,048-bit key and is signed with SHA-256. It is valid for 10 years, starting a day before it was made.
• For each website capture decrypts, ReqRes's capture extension makes a certificate in memory, valid for 90 days, and never writes it to disk.

Where its private key is#

The private key is kept in ReqRes's own container, in files only your user account can open. ReqRes hands it to its capture extension in memory when capture starts, and never sends it anywhere else.

Read this Mac's certificate details#

Click the ? button at the bottom of Settings ▸ Certificate. It opens "About the ReqRes Certificate", which explains what the certificate is and how to remove it. Under Its details, it lists the values read from this Mac's certificate: Organizational unit, Valid from, Expires, Key, Serial number and SHA-1. The organizational unit reads "Generated for this installation on" and the date. The SHA-256 is the one shown in the pane.

Remove the certificate by hand#

Deleting ReqRes does not remove its certificate or your trust in it. When you stop using ReqRes, remove the certificate.

In Keychain Access:

1. Open Keychain Access.
2. Choose the login keychain, then Certificates, and search for "ReqRes CA".
3. Double-click the certificate and check that the SHA-1 under Fingerprints matches the SHA-1 in "About the ReqRes Certificate".
4. Open Trust, set When using this certificate to Use System Defaults, and close the window. macOS asks for your password.
5. Select the certificate, press Delete, and confirm.

If a "ReqRes CA" is in the System keychain, the same steps apply there and need an administrator password.

In Terminal, list each "ReqRes CA" in your login keychain with its SHA-1:

security find-certificate -a -Z -c "ReqRes CA" ~/Library/Keychains/login.keychain-db | grep SHA-1

Then remove this Mac's certificate by its SHA-1. "About the ReqRes Certificate" shows this command with the fingerprint filled in and a Copy button:

security delete-certificate -t -Z THIS_MACS_SHA1 ~/Library/Keychains/login.keychain-db

The command deletes by fingerprint, not by name, so it removes exactly this certificate. Its -t removes your trust in it too, so macOS asks for your password.

If you exported the certificate as a file for command-line tools, delete that file and the lines that point to it.

Replace an old certificate#

If your keychain still has an older "ReqRes CA", from ReqRes 1.0.x or from an earlier installation on this Mac, ReqRes no longer uses it. When ReqRes opens, it offers to replace it in a sheet titled "Replace the Old ReqRes Certificate".

Replace Old Certificate does 3 things, in order:

1. It removes the old certificate's trust, then the certificate.
2. It installs and trusts this Mac's certificate.
3. It restarts capture if capture is running, so apps reconnect with the new certificate.

macOS asks for your password to change trust. If the old certificate is trusted for all users of this Mac, it asks for an administrator's password.

Not Now removes nothing. For the certificate from ReqRes 1.0.x, the sheet comes back at the next launch. For one from an earlier installation, it does not. Until the old certificate is gone, Settings ▸ Certificate shows a banner with the same Replace Old Certificate button.

Export it for command-line tools#

Tools such as node and Python's requests do not read the keychain, so they need the certificate as a file. Settings ▸ Capture ▸ Export CA Certificate… saves it, and the file holds the certificate only. If a file you exported earlier holds an older certificate, the CA certificate row marks it "holds an older CA — export again". See Capture command-line tools and agents.