安装mitmproxy，然后在手机的wifi连接开启代理。

用手机自带的浏览器打开网站：https://linuxdev.cc，此时弹出安全告警，该网站的安全证书有问题。

mitmproxy第一次启动会生成ca证书，路径如下，将其传入手机。

C:\Users\袁建鹏\.mitmproxy\mitmproxy-ca-cert.pem

C:\Users\袁建鹏\.mitmproxy\mitmproxy-ca-cert.cer

这两个文件是一模一样的。是pem格式的证书。

使用curl验证：

curl -vvl --cacert /sdcard/mitmproxy-ca-cert.pem --proxy 192.168.3.100:8080 https://linuxdev.cc

发现是可以的

在手机的设置中，将这个证书安装。证书安装在下列目录

/data/misc/user/0/cacerts-added/c8750f0d.0

浏览器仍然安全告警，curl也告警

# curl -vvl --proxy 192.168.3.100:8080 https://linuxdev.cc
14:41:38.323873 [0-0] * [HTTPS-CONNECT] created with 1 ALPNs -> 0
14:41:38.324569 [0-0] * [HTTPS-CONNECT] added
14:41:38.324666 [0-0] * [HTTPS-CONNECT] connect, init
14:41:38.325235 [0-0] *   Trying 192.168.3.100:8080...
14:41:38.326906 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
14:41:38.327035 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
14:41:38.340465 [0-0] * CONNECT tunnel: HTTP/1.1 negotiated
14:41:38.340733 [0-0] * allocate connect buffer
14:41:38.340887 [0-0] * Establish HTTP proxy tunnel to linuxdev.cc:443
14:41:38.341134 [0-0] > CONNECT linuxdev.cc:443 HTTP/1.1
14:41:38.341134 [0-0] > Host: linuxdev.cc:443
14:41:38.341134 [0-0] > User-Agent: curl/8.12.0-DEV
14:41:38.341134 [0-0] > Proxy-Connection: Keep-Alive
14:41:38.341134 [0-0] >
14:41:38.341762 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
14:41:38.341862 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
14:41:38.677170 [0-0] < HTTP/1.1 200 Connection established
14:41:38.677820 [0-0] <
14:41:38.678374 [0-0] * CONNECT phase completed
14:41:38.678902 [0-0] * CONNECT tunnel established, response 200
14:41:38.683455 [0-0] * ALPN: curl offers http/1.1
14:41:38.684428 [0-0] * TLSv1.2 (OUT), TLS handshake, Client hello (1):
14:41:38.685784 [0-0] *  CAfile: none
14:41:38.686423 [0-0] *  CApath: /system/etc/security/cacerts
14:41:38.687171 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
14:41:38.688168 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
14:41:38.728676 [0-0] * TLSv1.2 (IN), TLS handshake, Server hello (2):
14:41:38.729258 [0-0] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
14:41:38.730326 [0-0] * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
14:41:38.731324 [0-0] * TLSv1.3 (IN), TLS handshake, Certificate (11):
14:41:38.732076 [0-0] * TLSv1.3 (IN), TLS handshake, CERT verify (15):
14:41:38.733401 [0-0] * TLSv1.3 (OUT), TLS alert, unknown CA (560):
14:41:38.733958 [0-0] * SSL certificate problem: unable to get local issuer certificate
14:41:38.734489 [0-0] * [HTTPS-CONNECT] connect, all failed
14:41:38.735096 [0-0] * [HTTPS-CONNECT] connect -> 60, done=0
14:41:38.735546 [0-0] * closing connection #0
14:41:38.735908 [0-0] * [HTTPS-CONNECT] close
14:41:38.736543 [0-0] * [SETUP] close
14:41:38.737586 [0-0] * [SETUP] destroy
14:41:38.737918 [0-0] * [HTTPS-CONNECT] destroy
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

看日志，curl只用了系统ca证书目录：/system/etc/security/cacerts

直接使用该证书也不行，

# curl -vvl --cacert /data/misc/user/0/cacerts-added/c8750f0d.0 --proxy 192.168.3.100:8080 https://linuxdev.cc

PEM转der格式

openssl x509 -in mitmproxy-ca-cert.cer -outform DER -out mitmproxy-ca-cert.der

# md5sum /data/misc/user/0/cacerts-added/c8750f0d.0

9e20fadba2a897648d208f63490a3d88 /data/misc/user/0/cacerts-added/c8750f0d.0

$ md5sum mitmproxy-ca-cert.der

9e20fadba2a897648d208f63490a3d88 mitmproxy-ca-cert.der

可见手机安装的user trusted certificates是der格式。但是大部分应用程序不使用这个目录。也不支持这个格式

计算证书哈希值

$ openssl x509 -inform PEM -subject_hash_old -in mitmproxy-ca-cert.cer | head -1

c8750f0d

这个就是前面用户证书的名字的来由。

查看证书详情

一个证书只有编码后的内容。

$ cat mitmproxy-ca-cert.cer
-----BEGIN CERTIFICATE-----
MIIDNTCCAh2gAwIBAgIUUXF3yw9n6hs1FN9i1Rldd6kbNwcwDQYJKoZIhvcNAQEL
BQAwKDESMBAGA1UEAwwJbWl0bXByb3h5MRIwEAYDVQQKDAltaXRtcHJveHkwHhcN
MjYwNzA2MDk0MjQzWhcNMzYwNzAzMDk0MjQzWjAoMRIwEAYDVQQDDAltaXRtcHJv
eHkxEjAQBgNVBAoMCW1pdG1wcm94eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAOA5+Enjj9TbIWnQQia8p/EtpznZsfu7+d8AnWwprUunHvCQPclu7mKa
aSycr9vL4AS9wRvoUEIvXraS43scSIR0hC3EPPPDl7C9A3cwvgGAh/qnUPAxm78p
Z/O/AdPe2+cmzpi5zfAUbbbftyAnxwTVqVOmZSbZShKRgwHsCzDzx1FvrAHkhQzT
VLllNq1xpRO1RorSmBW73n3NR5md+j5SJ0qzPEOHE4xsQeZxBuQH5912cTpcqijp
UBMgSTumdDY1rm1Juns86kQfNKht5vUNXa6P3LauE1Sz1qkKlbhODDfRJ5+tH1jh
LMCEPk0w2pjK57z4D3a6xWNQ5p7i2bMCAwEAAaNXMFUwDwYDVR0TAQH/BAUwAwEB
/zATBgNVHSUEDDAKBggrBgEFBQcDATAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
FCS9AhLn9PiEFb6tnVLcExb5zsWzMA0GCSqGSIb3DQEBCwUAA4IBAQDSI98/jkLG
+Q9ULYASK6ZsmaXhiFoMGCF+Cx+WpNBbHYn7fSid7dpR5SJPwmzaCBzn66CbYki0
in4QzfH7ss3Wv436lv0d/xHkIXpqz/jy/9FytfMPP77INNAgzVSSvUiyNb38gYWE
xP+V9/snjOgz6s1lmQVwkIqpoEgLeKj6Im1XZHCAh4JBWAF2i9bJgmwI7w2ev+rB
vzt/m4PE++AcxEwewWt/WuZDl79lXujjbzlkp17wbd6jlkcTjYpJ3IsfgNoLqqmr
4VQ6BPgx5IRzkO+RZLvi8q0NL4luGoqBSe95Qhzt1dZLDfnJHaskVa1xiU1wFdGQ
6T0EWDxOLU92
-----END CERTIFICATE-----

它的subject信息，使用下面的命令可以参看

$ openssl x509 -in mitmproxy-ca-cert.cer -text -noout

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

51:71:77:cb:0f:67:ea:1b:35:14:df:62:d5:19:5d:77:a9:1b:37:07

Signature Algorithm: sha256WithRSAEncryption

Issuer: CN=mitmproxy, O=mitmproxy

Validity

Not Before: Jul 6 09:42:43 2026 GMT

Not After : Jul 3 09:42:43 2036 GMT

Subject: CN=mitmproxy, O=mitmproxy

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (2048 bit)

Modulus:

覆盖系统ca证书

# cp /system/etc/security/cacerts/ -a /data/

# cd /data/

# cp mitmproxy-ca-cert.pem cacerts/c8750f0d.0

# chmod 0644 cacerts/c8750f0d.0

# mount --bind cacerts/ /system/etc/security/cacerts/

使用bind mount临时覆盖，每次手机重启都需要mount一下。注意这里需要root权限，我的手机安装的测试版固件。

进入adb shell后，执行su就可以进入root账户。

也可以执行adb remount，这样system就可写了，直接拷贝进去。

15:08:54.486373 [0-0] * TLSv1.2 (OUT), TLS handshake, Client hello (1):
15:08:54.487420 [0-0] *  CAfile: none
15:08:54.487727 [0-0] *  CApath: /system/etc/security/cacerts
15:08:54.488029 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
15:08:54.488321 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
15:08:54.528095 [0-0] * TLSv1.2 (IN), TLS handshake, Server hello (2):
15:08:54.528634 [0-0] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
15:08:54.530415 [0-0] * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
15:08:54.531721 [0-0] * TLSv1.3 (IN), TLS handshake, Certificate (11):
15:08:54.532813 [0-0] * TLSv1.3 (IN), TLS handshake, CERT verify (15):
15:08:54.538325 [0-0] * TLSv1.3 (IN), TLS handshake, Finished (20):
15:08:54.538502 [0-0] * TLSv1.3 (OUT), TLS handshake, Finished (20):
15:08:54.538861 [0-0] * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / [blank] / UNDEF
15:08:54.539082 [0-0] * ALPN: server accepted http/1.1
15:08:54.539186 [0-0] * Server certificate:
15:08:54.539314 [0-0] *  subject: CN=linuxdev.cc
15:08:54.539426 [0-0] *  start date: Jul  6 12:02:56 2026 GMT
15:08:54.539531 [0-0] *  expire date: Jan 21 12:02:56 2027 GMT
15:08:54.539638 [0-0] *  subjectAltName: host "linuxdev.cc" matched cert's "linuxdev.cc"
15:08:54.539747 [0-0] *  issuer: CN=mitmproxy; O=mitmproxy
15:08:54.539850 [0-0] *  SSL certificate verify ok.

curl正常了，但是java程序还是不正常。原因是android 14后，自带的ssl实现使用的证书是

/apex/com.android.conscrypt/cacerts

/apex/com.android.conscrypt@360499999/cacerts

curl查看证书

curl --proxy 192.168.3.100:8080 https://linuxdev.cc -o /dev/null -w "%{certs}"

使用自己网站的证书

将私钥和full chain公钥一起放到一个文件。要完整验证一个证书，需要全链路签发证书。

$ cat privkey.pem fullchain.pem > linuxdev.pem

.\mitmweb.exe --certs *=linuxdev.pem

有个问题返回的subject是我的网站，访问别的网站时，会报

no alternative certificate subject name matches target hostname。

60|socrates:/ # curl -vvl --proxy 192.168.3.100:8080 https://galleryfaceapi.micloud.xiaomi.net
...
14:48:19.281523 [0-0] * ALPN: server accepted http/1.1
14:48:19.281696 [0-0] * Server certificate:
14:48:19.281876 [0-0] *  subject: CN=linuxdev.cc
14:48:19.282049 [0-0] *  start date: Jul  5 10:40:35 2026 GMT
14:48:19.282218 [0-0] *  expire date: Oct  3 10:40:34 2026 GMT
14:48:19.282397 [0-0] *  subjectAltName does not match hostname galleryfaceapi.micloud.xiaomi.net
14:48:19.282566 [0-0] * SSL: no alternative certificate subject name matches target hostname 'galleryfaceapi.micloud.xiaomi.net'
14:48:19.282743 [0-0] * [HTTPS-CONNECT] connect, all failed
14:48:19.282909 [0-0] * [HTTPS-CONNECT] connect -> 60, done=0
14:48:19.283093 [0-0] * closing connection #0
14:48:19.283269 [0-0] * [HTTPS-CONNECT] close
14:48:19.283436 [0-0] * [SETUP] close
14:48:19.283940 [0-0] * [SETUP] destroy
14:48:19.284152 [0-0] * [HTTPS-CONNECT] destroy
curl: (60) SSL: no alternative certificate subject name matches target hostname 'galleryfaceapi.micloud.xiaomi.net'
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

而使用mimt自己生成的证书，会自动修改subject。

使用magisk+MoveCertificate安装用户证书到系统证书

https://github.com/topjohnwu/Magisk

从这个官方releases下载Magisk-v30.7.apk

安装magisk

> adb install .\Magisk-v30.7.apk

此时magisk还没拿到root权限。

需要patch boot image，因为我的adb本身具有root权限，所以步骤非常简单，不需要fastboot。

> adb shell

> su

这样就进入root了

查看boot类型，有init就是init。

# ls /dev/block/by-name/ | grep boot

boot_a

boot_b

init_boot_a

init_boot_b

vendor_boot_a

vendor_boot_b

双分区init_bot_a/b内容是一样的。拷贝出来

# cp /dev/block/by-name/init_boot_a /sdcard/Download/init_boot.img

然后打开magisk app，选择首页的+安装，选择这个init_boot.img，它会生成一个patch后的image

# ls /sdcard/Download/

init_boot.img magisk_patched-30700_8VJPZ.img

在dd回去，重启，就ok了

# dd if=magisk_patched-30700_8VJPZ.img of=/dev/block/by-name/init_boot_b bs=4096

2048+0 records in

2048+0 records out

8388608 bytes (8.0 M) copied, 0.025 s, 320 M/s

# sync

# reboot

安装mitm的证书到用户证书。

然后安装MoveCertiface。

https://github.com/ys1231/MoveCertificate

下载MoveCertificate-v1.5.8.zip

> adb push .\MoveCertificate-v1.5.8.zip /sdcard/Download

然后再magisk模块从本地安装。

安装后重启，用户证书就安装到系统证书了。mitmproxy就可以抓包了