[GH-ISSUE #507] Support Custom Root Certificate

Originally created by @NghiaTranUIT on GitHub (May 29, 2025). Original GitHub issue: https://github.com/ProxymanApp/proxyman-windows-linux/issues/507 Originally assigned to: @kics223w1 on GitHub. ## Description - It's time to implement the Custom Root Certificate - Doc: https://docs.proxyman.com/advanced-features/custom-certificates - DO NOT Implement Client or Server Certificate. It's for the future ## Acceptance Criteria - [x] When there is no Root Certificate (default or custom), implement this UI <img width="812" alt="Image" src="https://github.com/user-attachments/assets/b442c82b-1130-4ace-be11-edc7f4e949e5" /> - [x] If we generate a default Root Certificate in Certificate Menu -> Install for Windows -> Manual or Auto Tab -> It will show the default certificate in the Custom Root Certificate <img width="812" alt="Image" src="https://github.com/user-attachments/assets/221fe2f8-942d-465d-9a6d-c383205435b3" /> - [x] Delete button is disabled if it's a Default Certificate, but enable if it's a custom Root certificate - [x] Able to import p12 (with passphrase) -> Decrypt p12 with password to PEM and Private Key and store in Proxyman Data Folder -> Custom Certificate Folder. Do not store user password <img width="220" alt="Image" src="https://github.com/user-attachments/assets/7dabd5b2-2ad4-49f6-bcb6-134247e32248" /> - [x] Make sure it shows an error if the passphrase is wrong. - [x] Able to import PEM / DER (This feature is not available on macOS). This view should be separated into components, we we can reuse it later for Server / Client Certificate <img width="1012" alt="Image" src="https://github.com/user-attachments/assets/3cc5e766-ee68-4d6d-a3db-54d5393e5e1b" /> - [x] After importing custom Root Certificate -> Verify that the UI displays ## Logic - [x] Maybe we should write new `CustomCertificateService.ts` to store and handle custom certificate (maybe we will use this class to store Client/Server customer certificate too) - [x] All custom certificates should be stored in ` Proxyman Data Folder -> Custom Certificate Folder` - [x] Do not store user p12 passphare. We decrypt p12 file to PEM and Private Key. - [x] Write a simple func to verify if it's a valid Root Certificate. Ping @NghiaTranUIT to get the idea. If it's invalid, still import it, but show warning yellow label on the UI to warning the user - [x] ✅ IMPORTANT LOGIC: If Custom Root Certificate is provided -> We should clear all cache certificates (read `ca.js`) and know where it's store and we should clear all cache and delete old server certificate (which was issued by old Root Certificate)

kerem commented

2026-03-03 19:51:01 +03:00

Owner

Originally created by @NghiaTranUIT on GitHub (May 29, 2025).
Original GitHub issue: https://github.com/ProxymanApp/proxyman-windows-linux/issues/507

Originally assigned to: @kics223w1 on GitHub.

Description

It's time to implement the Custom Root Certificate
Doc: https://docs.proxyman.com/advanced-features/custom-certificates
DO NOT Implement Client or Server Certificate. It's for the future

Acceptance Criteria

When there is no Root Certificate (default or custom), implement this UI

If we generate a default Root Certificate in Certificate Menu -> Install for Windows -> Manual or Auto Tab -> It will show the default certificate in the Custom Root Certificate

Delete button is disabled if it's a Default Certificate, but enable if it's a custom Root certificate
Able to import p12 (with passphrase) -> Decrypt p12 with password to PEM and Private Key and store in Proxyman Data Folder -> Custom Certificate Folder. Do not store user password

Make sure it shows an error if the passphrase is wrong.
Able to import PEM / DER (This feature is not available on macOS). This view should be separated into components, we we can reuse it later for Server / Client Certificate

After importing custom Root Certificate -> Verify that the UI displays

Logic

Maybe we should write new CustomCertificateService.ts to store and handle custom certificate (maybe we will use this class to store Client/Server customer certificate too)
All custom certificates should be stored in Proxyman Data Folder -> Custom Certificate Folder
Do not store user p12 passphare. We decrypt p12 file to PEM and Private Key.
Write a simple func to verify if it's a valid Root Certificate. Ping @NghiaTranUIT to get the idea. If it's invalid, still import it, but show warning yellow label on the UI to warning the user
✅ IMPORTANT LOGIC: If Custom Root Certificate is provided -> We should clear all cache certificates (read ca.js) and know where it's store and we should clear all cache and delete old server certificate (which was issued by old Root Certificate)

kerem added the

✅ Done

enhancement

labels

2026-03-03 19:51:02 +03:00

Author

@NghiaTranUIT commented on GitHub (May 29, 2025):

How to test

Generate new default Root Certificate -> When doing Mitm, make sure we generate Server Certificate by using Defualt Root Certificate (It's a default behavior) -> Open Google Chrome -> Click on the Certificate issue on Toolbar -> Verify Issued By is a current Root Certificate
Generate a new custom certificate with a different Organization Name by command line (Read https://docs.proxyman.com/advanced-features/custom-certificates)
Do not delete the current certificate -> Go to Certificate Menu -> Add new Custom Root Certificate -> Add p12 -> Enter passphare -> Import success -> UI is updated with new Custom Certificate -> Make sure all old certificates are cleared
When making a requests on Google Chrome -> verify Issued By is from the new CUstom Root Certificate
When I delete a custom root certificate -> Because the default root certificate is already installed -> It show the current Root certificate -> I can intercept and decrypt HTTPS as normal (by using Default Custom Certificate)

@NghiaTranUIT commented on GitHub (May 29, 2025): ## How to test 1. Generate new default Root Certificate -> When doing Mitm, make sure we generate Server Certificate by using Defualt Root Certificate (It's a default behavior) -> Open Google Chrome -> Click on the Certificate issue on Toolbar -> Verify `Issued By` is a current Root Certificate 2. Generate a new custom certificate with a different Organization Name by command line (Read https://docs.proxyman.com/advanced-features/custom-certificates) 3. Do not delete the current certificate -> Go to Certificate Menu -> Add new Custom Root Certificate -> Add p12 -> Enter passphare -> Import success -> UI is updated with new Custom Certificate -> Make sure all old certificates are cleared 4. When making a requests on Google Chrome -> verify `Issued By` is from the new CUstom Root Certificate 5. When I delete a custom root certificate -> Because the default root certificate is already installed -> It show the current Root certificate -> I can intercept and decrypt HTTPS as normal (by using Default Custom Certificate)

Rows
Columns

[GH-ISSUE #507] Support Custom Root Certificate #505

Description

Acceptance Criteria

Logic

How to test