Certificate

To decrypt HTTPS, apps on your device must accept certificates that MeowX signs. That only works once your device trusts MeowX’s certificate authority (CA). This page covers generating it, trusting it, and replacing it.

The certificate

• One per device. Each iPhone, iPad and Mac generates its own CA. There is no shared built-in CA, so a leaked key from someone else’s device can never be used against yours.
• Name. The certificate is called MeowX MITM CA followed by eight random hexadecimal characters (for example MeowX MITM CA 1A2B3C4D), so you can recognize it in system settings. The organization is MeowX.
• Algorithm and lifetime. ECDSA P-256 with SHA-256, valid for 10 years.
• Scope. It is restricted to TLS server authentication. On iOS the system only lets you enable it for websites (SSL); on the Mac MeowX trusts it for SSL only.
• Per-host certificates. When a connection is decrypted, MeowX signs a certificate for exactly the hostname the app asked for (never a wildcard), valid for one year and never longer than the CA. These are kept in memory only (up to 512) and discarded when the tunnel restarts.

The certificate card on the HTTPS Decryption page shows the state:

State	Meaning
Not generated	No certificate yet. Tap Generate Certificate.
Not installed or not trusted (iOS) / Not trusted (Mac)	The certificate exists but the system does not trust it yet, so HTTPS is not decrypted. Plain HTTP rewriting still works.
Trusted	Ready. The card shows the SHA-256 fingerprint.
Needs regeneration	The certificate and private key don’t match, for example after restoring from a backup or reinstalling MeowX. HTTPS decryption is off until you regenerate; plain HTTP is still rewritten.
Can’t read certificate	The keychain is temporarily unavailable, which happens when the device hasn’t been unlocked since it restarted. HTTPS decryption pauses; MeowX checks again when you return to it, or tap Recheck.

Note

On iOS, MeowX can’t tell “the profile isn’t installed” apart from “the profile is installed but full trust is off”, so both show as Not installed or not trusted. Follow both steps below.

MeowX checks trust by signing a test certificate with your CA and asking the system whether it would accept it for a website, with no special exceptions. It checks again every time you return to the app, and you can tap Recheck at any time.

Installing and trusting

iPhone and iPad

iOS doesn’t let apps install root certificates directly, so the certificate is delivered as a configuration profile that you install in Settings. MeowX also offers an illustrated guide (Guide on the certificate card).

1. Generate the certificate. In Me → HTTPS Decryption (MITM), tap Generate Certificate.

2. Download the profile with Safari. Tap Install. MeowX starts a temporary server that only listens on this device (127.0.0.1) and opens it in Safari. When Safari asks whether to allow the download, choose Allow. The temporary server stops after the profile has been downloaded once, or after two minutes.

3. Install it in Settings. Within 8 minutes, open Settings → General → VPN & Device Management, tap the profile under Downloaded Profile, then tap Install in the top-right corner and enter your passcode. A Profile Downloaded shortcut sometimes also appears at the top of the Settings home screen. The profile is shown as Not Signed; that is expected for this kind of profile.

4. Open Certificate Trust Settings. Installing is not the same as trusting. Go to Settings → General → About, scroll to the very bottom and open Certificate Trust Settings.

5. Turn on full trust. Turn on the switch for your MeowX MITM CA … certificate and confirm with Continue.

Return to MeowX; it detects the change automatically.

If it doesn’t install

• Deleted after 8 minutes. If you don’t install a downloaded profile within 8 minutes, iOS deletes it. Go back and tap Download Again.
• Only one at a time. Only one downloaded profile can be waiting to be installed. Downloading another one replaces the first.
• Stolen Device Protection. If it is on and you are away from a familiar location, you have to turn it off in Face ID & Passcode (or Touch ID & Passcode) before you can install a profile.
• Lockdown Mode. Profiles can’t be installed at all while Lockdown Mode is on.
• Safari didn’t offer the download. If your default browser isn’t Safari and no download prompt appeared, turn on HTTPS Decryption, connect MeowX, and open http://mitm.meowx in Safari. That address is answered by MeowX itself inside the tunnel and serves the same profile; it doesn’t work while the switch is off or MeowX is disconnected.

Mac

1. Open the HTTPS Decryption window (menu bar panel Settings → Overrides → HTTPS Decryption (MITM)) and go to Overview.

2. Click Generate Certificate.

3. Click Install and Trust. macOS asks for your login password or Touch ID to change certificate trust settings.

MeowX adds the certificate to your login keychain and marks it as trusted for SSL only, in your user’s trust settings. It deliberately does not trust it for anything else (such as S/MIME or IPsec).

If the card says the certificate is in the keychain but not trusted for SSL, click Install and Trust again. Remove from Keychain removes the trust setting and the certificate from the keychain (this also asks for authorization); the CA itself is kept in MeowX so you can install it again.

Mac limitations

• Only apps of the logged-in user trust it. Services running as root or as another user (launchd daemons, Homebrew services, updaters) don’t trust the certificate. If you decrypt hosts they use, they will fail to connect.
• Command-line tools that don’t read the keychain, such as builds of curl that use OpenSSL, Python and Node, don’t trust it either. In TUN mode MeowX also sets the system proxy, so these tools are decrypted too and then fail. Don’t add the hosts they use to the list.
• Enterprise or development CAs you trust only in your login keychain are not trusted when MeowX verifies servers from its TUN extension. Servers using them fall back to passthrough.
• Firefox trusts this certificate by default too, because it imports root certificates that you added to the system.

Regenerating the certificate

Use Regenerate on the certificate card if the card says Needs regeneration, or whenever you want a fresh key. After regenerating:

• Connections signed with the old certificate stop working immediately, and you must install and trust the new certificate before HTTPS is decrypted again.
• iOS: the old profile stays in Settings and MeowX can’t remove it. After installing the new one, delete the old profile in Settings → General → VPN & Device Management. MeowX reminds you until you dismiss the note.
• Mac: if the old certificate is still in your keychain, MeowX removes it automatically (the system asks for authorization once). If it isn’t there (for example after reinstalling MeowX), remove any leftover copy yourself in Keychain Access.

Exporting the certificate to share it between devices is not available yet; the Export button on iOS is shown as coming later.

Privacy of the private key

• The private key is created on your device and stored only in its keychain, with “this device only” protection: it is not synced through iCloud and not included in backups. Restoring a backup to a new device or reinstalling MeowX therefore leads to Needs regeneration, by design.
• It is never uploaded anywhere, including to your provider’s dashboard.
• On the Mac in TUN mode, the system extension receives the key directly from the app and keeps it only in memory. It is never written into the network extension’s configuration, which macOS stores in a file that every local user can read.
• When you turn off HTTPS (or the certificate stops being trusted), MeowX closes decrypted connections and stops handing the key material to new ones.

Never share your CA

Anyone who has your CA’s private key can impersonate any website to your device. MeowX keeps it in the keychain for this reason. If you suspect it has leaked, regenerate the certificate and remove the old one from your device’s trust settings.