I use Charles Proxy extensively for debugging all kinds of applications, and lately I’ve been using it more with mobile devices. One of the killer features of Charles is its ability to intercept SSL traffic. This is hard – and rightly so, it should be difficult to inspect SSL traffic!

Charles handles this by using the server’s SSL certificate for the connection from Charles to the remote server, and then using Charles’ own SSL certificate for the “last mile” back to your browser or device. This means that the connection will be flagged as insecure; Charles’ certificates aren’t trusted by your browser or device – but we can easily change that.

Get Charles’ Certificate

On Windows, you can grab the certificate from the Help menu in Charles, but for OS X or Linux you’ll need to download it from their website. It’s linked from this excellent documentation page about SSL: http://www.charlesproxy.com/documentation/using-charles/ssl-certificates/.

Install it On Your Android Device

Copy the “.crt“ file into the root of your SD card (I found this didn’t work in a subdirectory, although some documentation suggests it will). Under “Security” -> “Settings”, choose “install from device storage” and it should pick up the certificate you put on the SD card.

… that’s it :) Check you have enabled the destination for SSL proxying under “Proxy Settings” in Charles, and you’re all set!

Note, I have one device that refused to see the .crt file on the SD card, but when I emailed it to myself and then saved it from there, was added successfully. Thought I’d mention it!