Fiddler Root Certificate Installation Guide for HTTPS Decryption

Why Installing the Fiddler Root Certificate Is Essential

Fiddler acts as a man-in-the-middle (MITM) proxy to intercept, inspect, and modify HTTP and HTTPS traffic. While HTTP traffic flows in plaintext and requires no special setup, HTTPS decryption depends entirely on your system trusting Fiddler’s dynamically generated certificates. Without installing and trusting the Fiddler Root Certificate, you’ll see red warnings like "This certificate was issued by an untrusted authority" — and encrypted traffic will appear as opaque, unreadable tunnels.

This isn’t just about visibility: it’s foundational for fiddler debugging, API testing, mobile app analysis, and security validation. Whether you’re reverse-engineering a third-party API, validating TLS configuration, or diagnosing mixed-content issues, HTTPS decryption unlocks actionable insights. And because Fiddler generates certificates on-the-fly using its own root CA, that root must be installed and trusted at the OS level — not just within browsers.

Prerequisites Before You Begin

Before installing the root certificate, ensure:

You’re running Fiddler Classic (v5.0.20234.58100 or later) or Fiddler Everywhere (v1.22+). Fiddler Classic is recommended for full certificate control.
You have administrator privileges on Windows or administrator access (for Keychain) on macOS.
HTTPS decryption is enabled in Fiddler: Tools > Options > HTTPS > Decrypt HTTPS traffic ✅ (Classic) or Settings > HTTPS > Enable HTTPS decryption (Everywhere).
You’ve confirmed Fiddler is capturing traffic (File > Capture Traffic or F12).

💡 Tip: If HTTPS traffic appears grayed out or shows "Tunnel to" with no request/response bodies, HTTPS decryption is likely disabled or the root certificate isn’t trusted. This guide solves the latter.

Installing the Fiddler Root Certificate on Windows

Fiddler Classic includes an automated certificate installer — but manual steps are sometimes required, especially after Windows updates or Group Policy restrictions.

Step-by-step via Fiddler UI (Recommended)

Launch Fiddler Classic.
Go to Tools > Options > HTTPS.
Ensure Decrypt HTTPS traffic is checked.
Click Actions > Export Root Certificate to Desktop. This saves FiddlerRoot.cer to your desktop.
Now click Actions > Trust Root Certificate.
- A UAC prompt appears. Click Yes.
- Windows opens the Certificate Manager → Trusted Root Certification Authorities store.
- Confirm the certificate DO_NOT_TRUST_FiddlerRoot appears under Certificates.

✅ Done. Fiddler now signs all decrypted HTTPS sessions with a certificate signed by this trusted root.

Manual Installation (When Auto-Trust Fails)

If Trust Root Certificate fails silently or throws "Access denied", install manually:

Right-click FiddlerRoot.cer → Install Certificate.
Select Local Machine, click Next.
Choose Place all certificates in the following store → click Browse → select Trusted Root Certification Authorities → OK → Next → Finish.
Reboot Fiddler and verify HTTPS traffic shows full request/response tabs (not just tunnel entries).

Troubleshooting Windows Certificate Issues

Error: “The import failed because the certificate store is read-only” → Run Certificate Manager (certlm.msc) as Administrator, then drag/drop FiddlerRoot.cer into Trusted Root Certification Authorities > Certificates.
Corporate environments: Some enterprises disable user-trusted roots via Group Policy (Computer Configuration > Administrative Templates > System > Internet Communication Management > Internet Communication Settings > Turn off Automatic Root Certificates Update). Contact your IT team to whitelist DO_NOT_TRUST_FiddlerRoot.
Browsers ignoring trust: Chrome and Edge use Windows Certificate Store by default — but Firefox uses its own certificate manager. Learn how to import Fiddler’s root into Firefox.

Installing the Fiddler Root Certificate on macOS

macOS treats certificate trust more granularly than Windows. Simply importing isn’t enough — you must explicitly mark the root as trusted for SSL in Keychain Access.

Step-by-step via Fiddler Everywhere (macOS Native)

Launch Fiddler Everywhere.
Go to Settings > HTTPS and toggle Enable HTTPS decryption ON.
Click Export Certificate → save FiddlerRoot.cer to Downloads.
Double-click the .cer file. Keychain Access opens automatically.
In Keychain Access, select System keychain (not Login) — this is critical for system-wide trust.
Find DO_NOT_TRUST_FiddlerRoot in the list, double-click it.
Expand Trust, then set When using this certificate to Always Trust.
Close the window → enter your macOS password to confirm.
Restart Fiddler Everywhere and reload any HTTPS site (e.g., https://httpbin.org/get). Verify full request/response bodies appear.

Manual Import & Trust (Fiddler Classic on macOS via Wine or CrossOver)

Fiddler Classic doesn’t run natively on macOS — but if you’re using it via compatibility layers:

Export FiddlerRoot.cer from Windows or generate it via Tools > Options > HTTPS > Actions > Export Root Certificate.
Import into System keychain using Keychain Access (as above).
Always validate trust settings — macOS may reset them after updates.

Troubleshooting macOS Certificate Issues

“Safari shows ‘Not Secure’ even after trust”: Safari caches TLS state. Clear it: Safari > Settings > Privacy > Manage Website Data > Remove All. Then restart Safari and visit https://example.com.
Terminal/curl ignores Fiddler: Command-line tools don’t use Keychain trust. Use curl --proxy http://127.0.0.1:8888 --insecure https://httpbin.org/get (note --insecure bypasses cert validation — only for testing).
Keychain shows “This certificate is not trusted” after reboot: Reopen Keychain Access → right-click DO_NOT_TRUST_FiddlerRoot → Get Info → expand Trust → re-select Always Trust. Then lock/unlock the System keychain.

Verifying HTTPS Decryption Works

Don’t assume success — verify. These checks confirm your fiddler proxy is fully operational:

1. Inspect an HTTPS Session in Fiddler

Navigate to https://httpbin.org/headers in Chrome or Safari.
In Fiddler, find the session. Look for:
- Green lock icon ✅ (indicates successful decryption),
- Full Request Headers, Request Body, Response Headers, and Response Body tabs,
- Status code 200 and readable JSON in the response.
If you see Tunnel to httpbin.org:443 with no child sessions, decryption failed.

2. Check Certificate Chain

In Fiddler, select the HTTPS session → click the Inspectors tab → Headers → scroll to X-Fiddler-Session-Info.
Or right-click the session → Properties → view Client-Certificate-Issuer: should contain DO_NOT_TRUST_FiddlerRoot.

3. Browser-Level Confirmation

In Chrome, click the padlock → Connection is secure → Certificate is valid.
Click Certificate → check the issuer is DO_NOT_TRUST_FiddlerRoot. If it says “Unknown Authority”, trust wasn’t applied correctly.

Best Practices & Security Considerations

Installing a MITM root certificate carries real security implications. Follow these fiddler tutorial best practices:

Never export or share FiddlerRoot.cer outside your trusted machine. It enables decryption of all HTTPS traffic routed through your Fiddler instance.
Disable HTTPS decryption when idle: Toggle off Decrypt HTTPS traffic in Tools > Options > HTTPS to prevent accidental capture.
Use separate profiles: In enterprise or shared environments, consider using Fiddler’s Rules > Customize Rules to restrict decryption to specific domains (e.g., if (oSession.host.toLowerCase().indexOf("dev-api.example.com") > -1)).
Rotate periodically: While Fiddler regenerates leaf certs per-session, the root remains static. Reinstall the root annually or after major OS updates.
Mobile devices? To decrypt iOS/Android traffic, you must manually install FiddlerRoot.cer on the device and configure its Wi-Fi proxy to point to your computer’s IP + port 8888. See our complete mobile debugging guide.

Conclusion: Your HTTPS Debugging Workflow Is Now Complete

Installing the Fiddler Root Certificate is the single most important step to unlock full http debugging capabilities. Without it, you’re flying blind on encrypted traffic — missing headers, payloads, redirects, and auth flows that define modern web and API behavior.

You now know how to:

Install and trust the root certificate on both Windows and macOS,
Diagnose and resolve common trust failures,
Validate decryption end-to-end,
Apply security-aware usage patterns.

This foundation powers advanced fiddler debugging workflows — from mocking responses with AutoResponder, to scripting with FiddlerScript, to auditing third-party SDKs. Once HTTPS decryption works reliably, you’re equipped to tackle complex integration bugs, performance bottlenecks, and security misconfigurations with confidence.

For more hands-on scenarios, browse HTTP/HTTPS Capture tutorials, explore more tutorials, or contact us if you hit a platform-specific edge case we haven’t covered.

🔐 Final note: Fiddler never stores or transmits your decrypted traffic unless you explicitly save sessions (.saz files) or enable logging. Your data stays local — and your control, complete.