Why Titanium is creating new cert for every request?

[amitbhutta]

While working on titanium, I noticed that it creates and stores cert in certificate store for each and every request and in few days my personal cert store has hundreds of certs issued by titanium. I don't see any other proxy server behaving like this. Is there a way I can use only one CA trusted certificate and avoids creation of certs for every request? Thanks

[marcfielding1]

Actually they do! It has to install a ROOT certificate and then issues one for each https site you visit, you can easily clean them up automatically but it'll give a very slight performance trade off.

[justcoding121]

This is same issue as #13
We use makecert.exe (from microsoft) to generate certificates for each host name. It creates and store the requested certificate in to User Store. We read it from store.

So unless we replace makecert.exe with something else we can't avoid it from keep doing it.

Having said that one can safely delete the certificates anytime. (It is loaded in to the memory once proxy starts running). However if you restart the proxy its going to create it again unless it is found in certificate store.

I am looking at keeping a limit on the number of certificates the proxy caches in memory. For example keeping only recently used certificates in memory. This is potentially a problem for heavy traffic otherwise.

[amitbhutta]

Thanks for the Reply!
In any case, are you going to implement the functionality where user can use their own trusted cert and avoids titanium ones?

[justcoding121]

Its already there! (Not documented Sorry)
Set below values before you start the proxy.

ProxyServer.RootCertificateIssuerName = "Your trusted certificate issuer name";
ProxyServer.RootCertificateName = "Your trusted certificate name";

Your root certificate should be in local user root certificate store.
By default if you don't provide above values the proxy will create a random root certificate and install it on to the machine. (You will see that import dialog the first time you run the proxy).

[amitbhutta]

Thanks

[marcfielding1]

As an idea you could implement a function that cleans out all issued certificates and let the user sort out when/if they wanna do it - it's pretty easy to do!

Sent from my iPhone

On 3 Jun 2016, at 18:11, amitbhutta notifications@github.com wrote:

Thanks

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[justcoding121]

I just updated to delete certificates automatically and also implemented a timeout for certificate cache