throwaway8384
Re:Decrypting TLS Browser Traffic with Wireshark
on Thursday February 12, 2015 @05:25PM (#9041791)
No, Fiddler is an active ManInTheMiddle attack. With HTTPS interception it always substitutes the certificate (which is the public key).
The substituted public key allows the proxy to negotiate a TLS session between the browser and the proxy, impersonating the real server.
You avoid a certificate error if you install the signing CA certificate in the browser; but you still tamper with the traffic. There are scenarios where mitm doesn't work; for example Client Authenticated TLS. Things like certificate pinning, where the browser expects a specific public key, also break intetception.