HTTPS and the certificate

HTTPS traffic is encrypted between your app and the server. To show it, Puffin acts as a go-between: it presents your app with a certificate it made itself, and opens a second, normal connection to the real server. This only works if your Mac trusts Puffin’s certificate authority (CA).

The certificate authority

Each install creates its own root certificate. It is never shared and never shipped with the app.
The private key is kept in your login Keychain.
Puffin makes a certificate for each site as you visit it, so you do not need to manage them.

Manage the CA in Settings ▸ TLS:

Action	What it does
Install & Trust	Adds the certificate and trusts it for your user account. macOS asks for an administrator password.
Status	Shows whether the certificate is installed and trusted, without prompting you.
Export	Saves the certificate as `.pem` or `.cer`.
Regenerate	Replaces the root with a new one.
Remove & Untrust	Removes the certificate and its trust settings.

Decryption is opt-in

By default Puffin decrypts nothing. A host is decrypted only if it is on the SSL proxying list, and the list accepts wildcards such as *.example.com.

Hosts that are not listed are tunneled untouched. You see the host and byte counts, but not the content.
A bypass list excludes hosts, and bypass always wins over the decrypt list.
Right-click a request to enable SSL proxying for its host, or to bypass it.

Changes apply to connections opened afterwards.

The real server’s certificate

Puffin checks the real server’s certificate against your Mac’s trust, as a browser would. A failure shows up as an error on the request. If you must talk to a server with an invalid certificate, you can allow that for one host in Settings ▸ TLS.

Apps that refuse the certificate

Some apps pin certificates, or use their own list of trusted authorities. When an app drops the connection right after seeing Puffin’s certificate, Puffin marks the host “TLS rejected — likely pinned or CA not trusted” and offers a one-click bypass so the app can work normally.

If the app simply does not trust your Mac’s Keychain (Node, Python, curl with its own bundle, Firefox), see Environment variables.

TLS details

The TLS tab in the inspector shows the protocol version, cipher, negotiated protocol and the server’s certificate chain, with built-in help for each field.