HTTPS Decryption (Man-in-the-Middle Attack, MitM)

Chute may decrypt HTTPS traffic by MitM. Please see Wikipedia article for more information.

The certificate generator can help you generate a new CA certificate for debugging and make the certificate trusted by the system. It's available in Chute Mac and Chute iOS Chute Editor. This certificate is generated locally and only saved in your profile file and the system Keychain. The key of the new certificate is generated randomly using OpenSSL.

You can also use an existed CA certificate. Export the certificate to PKCS#12 format (.p12) with passphrase. Please note that the passphrase cannot be empty due to system limitation. Use "base64" command to encode in base64 string and append these settings below to your config file.

[MITM]
enable = true
ca-p12 = MIIJtQ.........
ca-passphrase = password
hostname = *google.com

Chute only decrypts traffic to hosts declared here.

Wildcard characters and ? are supported. Note that ? only acts as a wildcard when the rule also contains `; a rule containing only?` is compared literally.

• Use prefix - to exclude a hostname.
• By default, only the requests to port 443 be decrypted.
  • Use suffix :port to allow other ports.
  • Use suffix :0 to allow all ports.

Example:

• -*.apple.com: Excludes all requests sent to *.apple.com on port 443.
• www.google.com: Allows MitM for www.google.com on port 443.
• www.google.com:8080: Allows MitM for www.google.com on port 8080.
• www.google.com:0: Allows MitM for www.google.com on all ports.
• *: Allows MitM for all hostnames on port 443. (Not Recommanded)
• *:0: Allows MitM for all hostnames on all ports. (Not Recommanded)

A hostname entry may also include a path pattern after the first /. The host part is matched first to decide whether the connection is decrypted, then the path pattern filters which requests are decrypted and processed.

• example.com/api/*: Allows MitM for example.com on port 443, limited to requests whose path matches /api/*.

A general configuration may be like:

hostname = -*.apple.com, -*.icloud.com, *

Chute will apply URL Rewrite, Header Rewrite, Body Rewrite and Mock (Map Local) rules as well as scripts to all MitM requests.

MitM supports HTTP/2: Chute offers both h2 and http/1.1 to the client via ALPN. Surge's [MITM] keys h2 and tcp-connection are accepted in config files but ignored.

Some applications has strict security policy to use pinned certificates or CA. Enabling decryption to these hosts may casue problems.

Installing and trusting the CA certificate

Generating (or importing) the CA is only half of the setup — the operating system must also trust it. Until both steps are done, every decrypted site fails with a certificate warning. The certificate page in the app shows the current state ("Trusted CA Certificate" / "Not Trusted CA Certificate").

Chute iOS — in the configuration editor open MITM → Configure CA:

1. Generate A New CA Certificate (or Import P12 Certificate for an existing one).
2. Tap Install CA Certificate to System. A Safari page opens — tap Install Certificate and allow the download, then install the downloaded profile under Settings → General → VPN & Device Management.
3. Trust it: Settings → General → About → Certificate Trust Settings, and enable full trust for the Chute CA. This step is the one most people miss — without it the certificate is installed but not trusted, and decryption keeps failing.

Chute Mac — in the configuration window open MitM:

1. Generate New Certificate (or Import Certificate from PKCS#12 File).
2. Click Install the Certificate to System. macOS asks for an administrator password and adds the certificate to the System keychain as a trusted root — no manual Keychain Access steps are needed.
3. Export the Certificate saves a .pem copy for installing on other devices.

If a specific app still fails with a trusted certificate, it most likely pins its own certificates — exclude its hosts from hostname with a - prefix instead of fighting it.

Options

skip-server-cert-verify

skip-server-cert-verify = true

Do not verify the certificate of the remote host while performing MitM. When enabled, Chute will accept any certificate presented by the upstream server, including self-signed or invalid certificates. This is useful for development environments but reduces security.

[MITM]
enable = true
ca-p12 = MIIJtQ.........
ca-passphrase = password
skip-server-cert-verify = true
hostname = *google.com

Security Note: Enabling skip-server-cert-verify makes MitM connections vulnerable to man-in-the-middle attacks between Chute and the upstream server. Only enable this for trusted networks or development purposes.