Certificate Generator
Previous Back to contents Next

New to Proxomitron Reborn, a built-in certificate generator to assist you in creating a certificate for filtering HTTPS pages.

What do all the fields mean?

A certificate is a signed document that contains a subject, issuer, and a public key which is used as evidence of the certification. In the case of root (CA) certificates generated by Proxomitron, they are self-signed, meaning the subject and issuer are the same. You normally don't need to change the Common Name, Organizational Unit, Organization, STate, or Country fields unless you want to customize how your certificate looks in browsers when you inspect the "secure" properties of a site.

Certificates also have a range of dates on which they're valid, which you can adjust but the default (5 years from when you open the certificate generator) should work fine. Beware that newer, pickier browsers may not like a date too far into the future, meaning you may need to come here and regenerate a new certificate periodically; for your convenience, the other fields will have been filled in from the existing certificate, if you had one already loaded.

The cryptography parameters let you choose how "secure" the certificate will be; since this is only used to "fool" browsers into thinking they're talking to the site when they're actually talking to Proxomitron, it makes sense to choose the lowest security that your browser currently allows. A key size of 2048 and RSA-SHA256 is commonly accepted, but if your browser is fine with something weaker, that can help performance a little. On the other hand, you can also generate a far more secure 4096-bit RSA-SHA512 certificate if the situation calls for it.

Generating and Using Certificates

Once you click the Generate button (it may take some time to generate a certificate), Proxomitron will create or overwrite two files in its directory: proxcert.pem and proxcert_certonly.pem . The former contains both the certificate and private key, which Proxomitron needs to sign the site-certificates that it creates upon visiting each HTTPS site, if one doesn't already exist in memory. The latter is the certificate only, and is what you need to import into browsers' list of trusted root certificates to allow them to trust Proxomitron-filtered pages.

Proxomitron itself needs a list of trusted roots so that it can verify sites' certificates; this is found in the file "certs.pem" in its directory, and may periodically need to be updated. Here is a periodically updated list of trusted roots found in Mozilla Firefox, in a convenient Proxomitron-friendly format (just rename it to "certs.pem" and put it in Proxo's directory.)


Return to main index