Understanding Certificate Trust Manipulation in MITM Proxy Tools

A recent commit to mitmproxy added a peculiar new flag: --emudhra. On the surface, it looks like just another configuration option. But dig deeper and you’ll find it’s actually a fascinating window into how certificate authorities work, how trust chains are manipulated, and why understanding HTTPS interception matters for every IT professional working with network security, debugging, or compliance testing.

The commit itself is deceptively simple—it adds functionality to handle certificates from eMudhra, a certificate authority commonly used in India for digital signatures and government services. But the real story here isn’t about one CA. It’s about the fundamental mechanics of how man-in-the-middle proxies work, and why mastering these tools gives you superpowers when troubleshooting encrypted traffic.

Table of Contents

• What mitmproxy Actually Does Under the Hood
• The Certificate Trust Problem
• Practical HTTPS Interception Setup
• Real-World Debugging Scenarios
• Security Implications You Need to Know

What mitmproxy Actually Does Under the Hood

Before we dive into certificate handling, let’s establish what mitmproxy fundamentally does. It sits between your client and the server, intercepting traffic in both directions. For HTTP, this is straightforward. For HTTPS, it’s deliciously complex.

When you connect to https://example.com through mitmproxy, the proxy terminates the TLS connection from your client, then establishes a separate TLS connection to the actual server. You’re not talking directly to example.com—you’re talking to mitmproxy, which is talking to example.com. This is the “man in the middle.”

The magic trick? Your browser needs to trust mitmproxy’s certificate. This is where the --emudhra flag becomes relevant. Some certificate authorities, especially those used for code signing or government digital signatures, need special handling because their certificates might be pinned, expected in certain formats, or validated against specific intermediate CAs.

The Certificate Trust Problem

Here’s where things get interesting. When mitmproxy intercepts an HTTPS connection, it generates a certificate on the fly for the target domain. This certificate is signed by mitmproxy’s own CA certificate. For this to work transparently, your system needs to trust mitmproxy’s CA.

Installing mitmproxy’s CA certificate into your system’s trust store is straightforward for testing environments. But what happens when applications expect certificates from specific authorities? This is exactly what the eMudhra option addresses. Applications expecting eMudhra-signed certificates might perform additional validation checks—verifying the issuer DN (Distinguished Name), checking for specific certificate extensions, or validating against a known intermediate CA chain.

Understanding these trust mechanisms isn’t just academic. If you’re debugging API integrations, testing mobile applications, or analyzing third-party services, you need to know how certificate validation works. Platforms like Coursera offer comprehensive courses on network security and cryptography that cover these concepts in depth, particularly valuable when dealing with enterprise certificate management.

Practical HTTPS Interception Setup

Let’s get hands-on. Here’s how to set up mitmproxy for intercepting HTTPS traffic, which is essential for debugging web services, analyzing API calls, or testing how applications handle TLS errors.

Basic mitmproxy Installation and Certificate Setup

# Install mitmproxy (on Linux/macOS)
pip install mitmproxy

# Start mitmproxy on port 8080
mitmproxy --listen-port 8080

# The CA certificate is automatically generated at ~/.mitmproxy/mitmproxy-ca-cert.pem
# Install this certificate in your system's trust store

On Linux, installing the CA certificate typically looks like this:

# Copy the certificate to the system CA directory
sudo cp ~/.mitmproxy/mitmproxy-ca-cert.pem /usr/local/share/ca-certificates/mitmproxy.crt

# Update the CA certificate store
sudo update-ca-certificates

# Verify the certificate was added
ls -l /etc/ssl/certs/ | grep mitmproxy

Once installed, configure your application or browser to use 127.0.0.1:8080 as its proxy. Now all HTTPS traffic flows through mitmproxy, and you can inspect requests and responses in real-time.

Advanced Certificate Handling

The --emudhra flag represents a more sophisticated use case. While the exact implementation details are in the commit, the principle applies broadly: sometimes you need to present certificates that match specific CA characteristics. This might involve:

• Using specific certificate serial number ranges
• Including particular X.509 extensions
• Matching issuer DN formatting exactly
• Preserving specific certificate policies

For security professionals, understanding these nuances is crucial. Interactive platforms like DataCamp provide practical exercises in cryptography and security that complement hands-on tool mastery like this.

Real-World Debugging Scenarios

Why does any of this matter in your daily work? Consider these scenarios I’ve encountered repeatedly:

Scenario 1: Mobile API Debugging

You’re integrating with a third-party payment API that’s failing mysteriously. The documentation is sparse, and the error messages are unhelpful. By routing your test device through mitmproxy, you can see the exact request format, headers, and response bodies. You discover the API expects a specific certificate in the client’s trust chain—something not documented anywhere.

Scenario 2: Compliance Testing

Your application needs to comply with regulations requiring specific certificate authorities for government services. You need to verify that your application correctly validates certificates from authorities like eMudhra. Using mitmproxy with appropriate flags, you can simulate various certificate scenarios—expired certificates, wrong issuers, missing intermediate CAs—to ensure your validation logic is robust.

Scenario 3: Legacy System Integration

You’re maintaining a legacy system that mysteriously rejects certain HTTPS connections. By intercepting the traffic, you discover it’s checking for specific certificate extensions that modern CAs have deprecated. This is exactly the kind of edge case that special CA handling flags help you test.

Security Implications You Need to Know

Understanding MITM proxies isn’t just about debugging—it’s about security awareness. If you can intercept your own traffic, so can attackers with the right positioning. This is why:

• Certificate pinning exists: Mobile apps pin certificates to prevent MITM attacks, even if the attacker compromises the system trust store
• HSTS matters: HTTP Strict Transport Security prevents downgrade attacks that might bypass certificate validation
• Certificate Transparency helps: CT logs make it harder for rogue CAs to issue unauthorized certificates

The eMudhra flag in mitmproxy highlights another dimension: regional and institutional certificate authorities that might not be widely known but are critical in specific contexts. Indian government services, for instance, often require eMudhra certificates for digital signatures. If you’re building systems that need to interoperate with these services, you need to understand their certificate requirements.

When you’re testing such integrations, you might need to simulate responses from services that use these specific CAs. That’s where specialized proxy flags become invaluable—they let you craft test scenarios that accurately reflect production behavior without needing actual access to production systems.

Building Secure Testing Environments

Here’s a practical approach to using mitmproxy securely in development:

1. Isolate your testing environment: Use virtual machines or containers that are clearly marked as non-production
2. Document your proxy usage: Maintain clear records of when and why you’re intercepting traffic
3. Rotate your CA certificates: Don’t use the same mitmproxy CA forever; regenerate it periodically
4. Audit trust stores: Regularly check what certificates are trusted on your systems

The beauty of tools like mitmproxy is they demystify HTTPS. Once you’ve intercepted your own traffic, debugged certificate issues, and understood how trust chains work, you have a much deeper appreciation for why certificate validation matters and where it can fail.