Environment variables

Browsers and most Mac apps trust the certificates in your Keychain. Many command-line tools and runtimes do not. They carry their own list of trusted authorities, and they reject Puffin’s certificate until you point them at it.

Copy the exports

In Settings ▸ TLS, choose Copy environment exports. Puffin saves a copy of its root certificate (a PEM file) in ~/Library/Application Support/Puffin Proxy, and puts lines like these on your clipboard:

export NODE_EXTRA_CA_CERTS='<path to the PEM>'
export REQUESTS_CA_BUNDLE='<path to the PEM>'
export SSL_CERT_FILE='<path to the PEM>'
export CURL_CA_BUNDLE='<path to the PEM>'

Paste them into a terminal and start the tool from there. They last only for that terminal window.

Variable	Used by
NODE_EXTRA_CA_CERTS	Node.js
REQUESTS_CA_BUNDLE	Python’s requests library
SSL_CERT_FILE	OpenSSL-based tools
CURL_CA_BUNDLE	curl

Caution

REQUESTS_CA_BUNDLE, SSL_CERT_FILE and CURL_CA_BUNDLE replace the tool’s normal list of trusted authorities. If a tool then fails to reach sites you did not decrypt, unset the variable for that run.

For that reason, avoid putting these lines in your shell profile. They would apply to every tool in every terminal, and would start failing if the certificate file is ever removed or replaced.

Firefox

Firefox keeps its own certificate store. The app shows a note in Settings ▸ TLS about Firefox’s enterprise-roots setting, which lets it use the certificates your Mac trusts.

Remember

Tools only pass through Puffin if they are among the captured apps, and only hosts on the decrypt list are readable. See Choosing what to capture and HTTPS and the certificate.