4

I need to intercept certain HTTPS traffic from the local application to the remote web site. On Win7 it was easy enough to achieve by using http://FiddlerTool.com Now I am running the Windows10 box, and no matter what I do, the system does not trust the temp certificates generated by fiddler. The steps performed so far: 1. Used the action "Trust root certificate" from Fiddler settings/Https/Actions menu 2. Exported the root cert onto the desktop, imported into both Local Machine's and current users Trusted Root Authorities sections

Still IE reports "the certificate is not issued by a trusted root authority", and the client app I need to trace complains that "it is not possible to establish a secure SSL/TLS connection with the remote host", which is the same diag in other words.

3
  • 1
    All you should have to do is place the certificate in the Certificate Store. If isn't being trusted its for some reason, which isn't apparent, based on the information you have provided.
    – Ramhound
    Nov 23, 2015 at 12:15
  • I followed fiddler's directions and I do not get a prompt from IE.
    – surfasb
    Nov 23, 2015 at 15:40
  • Thanks for the replies. What additional information can I provide in order to troubleshoot this? The IE keeps telling me that "This certificate cannot be verified up to a trusted certification authority", that's it. The "Certification path" shows only the current certificate with no parents: [i.stack.imgur.com/iSUAy.png] And the issuer certificate has definitely been added to the trusted root authorities: [i.stack.imgur.com/l6oeT.png] Nov 24, 2015 at 8:14

5 Answers 5

2

I had a similar issue whereby not HTTPS traffic could be picked up by Fiddler in Windows 10.

Resolved as follows: In Fiddler (v4.6.2): Tools Menu >> Fiddler Options >> HTTPS Tab >> Actions button >> Reset All Certificates.

Apparently the issue (at least the one I was having) was caused by having a mixture of old and new certs:

I’ve made changes to the latest versions of Fiddler to improve the performance of certificate creation, and to avoid problems with new certificate validation logic coming to Chrome and Firefox. The biggest of the Fiddler changes is that CertEnroll is now the default certificate generator on Windows 7 and later. Unfortunately, this change can cause problems for users who have previously trusted the Fiddler root certificate; the browser may show an error message like NET::ERR_CERT_AUTHORITY_INVALID or The certificate was not issued by a trusted certificate authority.

Ref: https://textslashplain.com/2015/10/30/reset-fiddlers-https-certificates/

2
  • worked like a charm! Mar 3, 2017 at 12:05
  • It doesn't resolve at windows 10, unable to configure windows to trust the fiddler root. any other solution?
    – Wasim A.
    Apr 1, 2019 at 8:41
1

Ok, looks like I've figured it out. In order to fix this issue, I had to install the certificate into a specific Physical store under Trusted Root Authorities- the Enterprise one. Importing into the Registry store doesn't help.

1
  • No, hurried a bit and incorrectly tested - still doesn't work. Nov 25, 2015 at 7:54
1

I reset my certificates by Tool > Options > HTTPs > Action > Reset all certificates but it doesn't work.

This is how I fixed my problem

  • Restart service CryptSvc.
  • Right click HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots
  • Permission > Current Windows Users > Full Access
  • Delete Full Key HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root
  • Restart Windows and that's it

Ref: https://www.addictivetips.com/windows-tips/fix-chrome-not-working-windows-10/

1
  • This worked, but I had to take ownership of ProtectedRoots first, and then change the permissions. I didn't have a Current Windows User principal. Jul 15, 2019 at 17:55
0

When configuring Telerik's Fiddler to handle HTTPS, I could not get root certificate installed. The error was "Failed to find the root certificate in User Root List". I solved the problem by temporarily turning off WebRoot, my antivirus program, then reattempting to enable HTTPS handling which installs Fiddler's root certificate. You may have to click the Action button on the HTTPS tab to remove/reset previous certificates before being able to create a new certificate.

1
  • Please do not post the same answer to multiple questions. If the same information really answers both questions, then one question (usually the newer one) should be closed as a duplicate of the other. You can indicate this by voting to close it as a duplicate or, if you don't have enough reputation for that, raise a flag to indicate that it's a duplicate. Otherwise tailor your answer to this question and don't just paste the same answer in multiple places.
    – DavidPostill
    Apr 24, 2017 at 14:24
0

I had the same issue after a domain migration and the following fixed it:

  • Open regedit as admin
  • Go to HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots
  • Right mouse button , permissions
  • Message You do not have permissions to view the current permission settings for ProtectedRoots, but you can make permission changes.
  • Set Owner to MachineName\Administrators
  • Set your NewDomain\Username to READ
  • Set NT SERVICE\CryptSvc to Full Control (if needed)
  • Press OK and close the permissions window.
  • Re-open the permissions and change the owner to SYSTEM
  • Go to HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ and check the permissions over there. We noticed that the Owner was still OldDomain\Username

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .