Secure Certificate Handling for HTTPS MITM with Titanium.Web.Proxy
Budget: $30 – $250 USD
Background
We have a .NET application that uses Titanium.Web.Proxy to monitor and inspect network traffic (HTTP/HTTPS) from an embedded WebView2 browser. HTTPS traffic must be decrypted (TLS MITM) and processed in real time.
WebView2 is launched with an explicit proxy (--proxy-server=127.0.0.1:port), and all traffic is routed through the Titanium proxy.
Problem
By default, Titanium.Web.Proxy automatically generates and installs its own root certificate into the system. This certificate is accessible to other applications on the machine, which presents a potential security risk.
We want to replace this behavior with a pre-generated, secured root certificate (PFX) with a custom password, used exclusively by our application.
Objective
- Enable HTTPS decryption in Titanium.Web.Proxy using a custom root certificate with proper configuration and secure usage.
Deliverables
- A C# method or standalone utility that:
- Creates a valid self-signed CA certificate (.pfx)
- Allows the certificate to be used as RootCertificate in Titanium.Web.Proxy without errors
- Saves a .cer version and installs it into the Trusted Root Certification Authorities (CurrentUser)
Example code that:
- Loads the custom PFX certificate into Titanium with proxyServer.CertificateManager.RootCertificate
- Disables automatic installation by Titanium using proxyServer.CertificateManager.TrustRootCertificate(false)
- Works with WebView2 and successfully intercepts HTTPS traffic using BeforeRequest / BeforeResponse events
Requirements
- The certificate must be generated programmatically
- Must work in .NET Framework
- WebView2 must be able to load HTTPS pages via the proxy without showing ERR_CONNECTION_CLOSED
- Only the application with access to the PFX password should be able to use the certificate
We have a .NET application that uses Titanium.Web.Proxy to monitor and inspect network traffic (HTTP/HTTPS) from an embedded WebView2 browser. HTTPS traffic must be decrypted (TLS MITM) and processed in real time.
WebView2 is launched with an explicit proxy (--proxy-server=127.0.0.1:port), and all traffic is routed through the Titanium proxy.
Problem
By default, Titanium.Web.Proxy automatically generates and installs its own root certificate into the system. This certificate is accessible to other applications on the machine, which presents a potential security risk.
We want to replace this behavior with a pre-generated, secured root certificate (PFX) with a custom password, used exclusively by our application.
Objective
- Enable HTTPS decryption in Titanium.Web.Proxy using a custom root certificate with proper configuration and secure usage.
Deliverables
- A C# method or standalone utility that:
- Creates a valid self-signed CA certificate (.pfx)
- Allows the certificate to be used as RootCertificate in Titanium.Web.Proxy without errors
- Saves a .cer version and installs it into the Trusted Root Certification Authorities (CurrentUser)
Example code that:
- Loads the custom PFX certificate into Titanium with proxyServer.CertificateManager.RootCertificate
- Disables automatic installation by Titanium using proxyServer.CertificateManager.TrustRootCertificate(false)
- Works with WebView2 and successfully intercepts HTTPS traffic using BeforeRequest / BeforeResponse events
Requirements
- The certificate must be generated programmatically
- Must work in .NET Framework
- WebView2 must be able to load HTTPS pages via the proxy without showing ERR_CONNECTION_CLOSED
- Only the application with access to the PFX password should be able to use the certificate