TLS & Certificates How HTTPS works and how ProxyServer decrypts it

This guide explains TLS from first principles — what problem it solves, how certificates create trust, and how ProxyServer intercepts encrypted traffic by becoming a trusted man-in-the-middle.

The Problem HTTPS Solves

HTTP is plaintext. Anyone on the same network (a coffee shop, your ISP, a corporate firewall) can read your traffic:

HTTPS wraps HTTP inside TLS (Transport Layer Security), which provides two things:

1. Encryption — The data is scrambled so only the intended recipient can read it
2. Authentication — You can verify you're talking to the real server, not an impersonator

How TLS Certificates Work

What Is a Certificate?

A TLS certificate is an electronic document (X.509 format) that binds a public key to a hostname. When you connect to example.com, the server sends its certificate which says "I am example.com, and here is my public key." Your browser uses the public key to set up an encrypted channel.

A certificate contains:

The Chain of Trust

How does your browser know to trust a certificate? Through a chain of trust:

1. Your OS/browser ships with ~150 Root CAs pre-trusted
2. The server's certificate says "DigiCert signed me"
3. The browser finds DigiCert in its trusted root store
4. It verifies the cryptographic signature to confirm DigiCert actually signed it
5. If the chain is valid and the hostname matches, the browser shows the lock icon

The TLS Handshake (Simplified)

After the handshake, both sides have agreed on a shared secret key. All subsequent data is encrypted with this key.

How MITM Interception Works

ProxyServer intercepts HTTPS by creating two separate TLS sessions:

Step by Step

1. CONNECT tunnel

   The browser sends CONNECT example.com:443. This is the HTTP method used to establish a tunnel through a proxy. ProxyServer responds with 200 Connection Established — the tunnel is open.

2. Proxy generates a fake certificate

   Instead of blindly tunneling bytes, ProxyServer intercepts the TLS handshake. It generates a certificate for example.com on the fly, signed by its own CA (certs/ca.crt). Because you've trusted this CA, the browser accepts the fake cert.

3. Client-side TLS session

   The browser completes its TLS handshake with the proxy, thinking it's talking to example.com. Data flows encrypted between browser and proxy.

4. Server-side TLS session

   The proxy opens a separate TLS connection to the real example.com. It tries HTTP/2 first (via ALPN negotiation), falling back to HTTP/1.1.

5. Plaintext in the middle

   The proxy decrypts data from the browser, inspects it, logs it to TrafficStore, then re-encrypts and sends it to the real server (and vice versa for responses).

ProxyServer's Certificate System

CA Certificate Generation

On first run, CertManager generates a self-signed root CA:

Per-Host Certificate Generation

When you visit example.com through the proxy for the first time:

1. CertManager.getHostCert("example.com") is called
2. It checks the memory cache (Map) — cache miss
3. It checks the disk cache (certs/hosts/example.com.key / .crt) — cache miss
4. It generates a new 2048-bit RSA key pair
5. Creates a certificate with:
   • Subject: CN=example.com
   • Issuer: the CA certificate's subject
   • SAN (Subject Alternative Name): DNS:example.com
   • Validity: 2 years
6. Signs it with the CA's private key
7. Caches to disk and memory

Certificate Caching

The first request to a new host takes 200-500ms due to RSA key generation (done in pure JavaScript by node-forge). Subsequent requests are instant.

Trusting the CA Certificate

macOS

# Add to system keychain (covers Chrome + Safari + most apps)
sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain certs/ca.crt

# Verify it was added
security find-certificate -a -c "ProxyServer CA" /Library/Keychains/System.keychain

Firefox

Firefox uses its own certificate store and ignores the system keychain:

1. Open Preferences > Privacy & Security
2. Scroll to Certificates > click View Certificates
3. Go to the Authorities tab
4. Click Import and select certs/ca.crt
5. Check "Trust this CA to identify websites"

Linux (Chrome/Chromium)

# Ubuntu/Debian
sudo cp certs/ca.crt /usr/local/share/ca-certificates/proxyserver-ca.crt
sudo update-ca-certificates

# For Chrome specifically
certutil -d sql:$HOME/.pki/nssdb -A -t "C,," \
  -n "ProxyServer CA" -i certs/ca.crt

Removing the CA

# macOS — remove from system keychain
sudo security remove-trusted-cert -d certs/ca.crt

# Or delete everything and regenerate
rm -rf certs/
node server.js  # generates a fresh CA

Troubleshooting