Fiddler Root Certificate Setup: Windows & macOS Guide

Why Installing the Fiddler Root Certificate Is Non-Negotiable

Fiddler acts as a man-in-the-middle (MITM) proxy — the only way it can decrypt and inspect HTTPS traffic is by generating on-the-fly certificates signed by its own trusted root authority. Without installing and trusting the Fiddler root certificate, your browser or app will display warnings like "Your connection is not private" or outright block decrypted traffic. This isn’t optional configuration — it’s foundational for reliable https decryption, secure fiddler debugging, and accurate http debugging.

This guide walks you through installing and validating the Fiddler root certificate on both Windows and macOS — with attention to modern security requirements (e.g., macOS 14+ certificate trust policies, Windows Defender SmartScreen bypasses, and Chrome/Edge certificate pinning workarounds). Whether you're reverse-engineering APIs, testing OAuth flows, or auditing third-party SDKs, correct certificate setup ensures clean, actionable traffic visibility.

Prerequisites Before You Begin

Before installing the root certificate, ensure:

Fiddler Classic (v5.0.20234.57833+) or Fiddler Everywhere (v1.22.0+) is installed and running.
You have administrator privileges on Windows or admin access on macOS.
Your system clock is synchronized (certificate validation fails if time is skewed by >5 minutes).
Antivirus or endpoint protection tools are temporarily disabled — some flag Fiddler’s MITM behavior as suspicious.

💡 Pro Tip: Fiddler Classic auto-generates its root certificate on first launch. Fiddler Everywhere creates it during initial proxy activation. If you’ve previously reset or corrupted the cert store, delete %USERPROFILE%\Documents\Fiddler2\Certificates (Windows) or ~/Library/Application Support/Fiddler/Certificates (macOS) and restart Fiddler to regenerate.

Installing the Fiddler Root Certificate on Windows

Step 1: Export the Certificate from Fiddler

Launch Fiddler Classic.
Go to Tools → Options → HTTPS.
Ensure Decrypt HTTPS traffic is checked.
Click Actions → Export Root Certificate to Desktop.
- This saves FiddlerRoot.cer to your desktop.

⚠️ Note: Do not use the .pfx file unless you’re configuring remote devices (e.g., Android emulators). For local Windows debugging, the .cer (public-only) format is safer and sufficient.

Step 2: Install the Certificate into Trusted Root CA

Double-click FiddlerRoot.cer.
Click Install Certificate… → Choose Local Machine → Click Next.
Select Place all certificates in the following store → Click Browse → Choose Trusted Root Certification Authorities → OK → Next → Finish.
Confirm The import was successful.

Step 3: Bypass Windows Defender SmartScreen (if blocked)

If Windows blocks the install with “Windows protected your PC”, click More info, then Run anyway. SmartScreen may flag Fiddler’s unsigned certificate installer — this is expected and safe only when installing from the official Telerik/Fiddler site.

Step 4: Verify Installation & Test Decryption

In Fiddler, go to Tools → Options → HTTPS, confirm Decrypt HTTPS traffic remains enabled.
Visit https://example.com in Chrome or Edge.
Check Fiddler’s Web Sessions list: you should see green (decrypted) HTTPS entries — not red (tunnel-only) ones.
Right-click any session → Properties → Under Server Certificate, verify the issuer reads DO_NOT_TRUST_FiddlerRoot.

If sessions remain red, check whether Chrome/Edge has certificate pinning enabled for that domain (e.g., google.com, microsoft.com). Fiddler cannot decrypt pinned domains — use https://httpbin.org/get for reliable testing.

Installing the Fiddler Root Certificate on macOS

Step 1: Locate and Export the Certificate

Fiddler Everywhere (recommended for macOS) stores certs in ~/Library/Application Support/Fiddler/Certificates/. Fiddler Classic for macOS is deprecated; we assume Fiddler Everywhere v1.22+.

Launch Fiddler Everywhere.
Open Settings → HTTPS.
Toggle Capture HTTPS traffic ON.
Click Export Certificate — save as FiddlerRoot.cer.

📌 macOS does not support .pfx imports via Keychain Access. Always export as .cer.

Step 2: Import into Keychain Access

Open Keychain Access (via Spotlight or /Applications/Utilities/Keychain Access.app).
In the left sidebar, select System keychain (required for system-wide trust — not Login).
Drag FiddlerRoot.cer onto the Keychain Access window, or choose File → Import Items…, navigate to the file, and select System keychain.
Enter your macOS admin password when prompted.

Step 3: Configure Trust Settings (Critical for macOS 12+)

macOS enforces stricter trust policies. Simply importing isn’t enough:

In Keychain Access, expand System → find DO_NOT_TRUST_FiddlerRoot.
Double-click the certificate → Expand Trust → Set When using this certificate: to Always Trust.
Close the window → Enter password to confirm changes.

🔑 Important: You must set trust at the certificate level and re-lock the System keychain (right-click → Lock Keychain “System”) for changes to apply. Then unlock again.

Step 4: Reset Network Stack & Validate

After installing:

Restart your browser (quit completely — Cmd+Q — don’t just close tabs).
In Terminal, run: sudo killall -HUP mDNSResponder (refreshes DNS cache) and networksetup -setwebproxy Wi-Fi 127.0.0.1 8866 (if using manual proxy config).
Test with https://httpbin.org/headers — inspect the session in Fiddler Everywhere. Look for decrypted JSON response body and a green lock icon in the Secure column.

If Safari shows This Connection Is Not Private, revisit Step 3 — incomplete trust settings are the #1 cause of failure on macOS.

Common Issues & Troubleshooting

❌ “Certificate Not Trusted” Despite Installation

Windows: Run certmgr.msc → check Trusted Root Certification Authorities → look for duplicate or expired DO_NOT_TRUST_FiddlerRoot entries. Delete old ones and re-import.
macOS: Run security dump-trust-settings -d in Terminal. If DO_NOT_TRUST_FiddlerRoot doesn’t appear under trusted status, reapply trust manually (Step 3 above).

❌ HTTPS Sessions Still Show as “Tunnel to…”

This means Fiddler captured the TLS handshake but couldn’t decrypt the payload. Causes include:

Missing or misconfigured proxy settings in your browser/app (verify proxy is set to 127.0.0.1:8866 for Fiddler Everywhere or 8888 for Classic).
Apps using certificate pinning (e.g., banking apps, Slack, Zoom). These ignore system trust stores — Fiddler cannot decrypt them without binary patching (out of scope for standard fiddler proxy usage).
Corporate MDM or endpoint protection overriding certificate trust (common in enterprise environments — consult your IT team).

❌ Fiddler Won’t Generate a New Certificate

Corrupted cert store? Try:

Windows: Delete %USERPROFILE%\Documents\Fiddler2\Certificates, restart Fiddler, re-enable HTTPS decryption.
macOS: Remove ~/Library/Application Support/Fiddler/Certificates, quit Fiddler Everywhere, relaunch, and re-export.

❌ Chrome/Edge Ignores System Certificate Store

Chromium-based browsers on Windows sometimes bypass the Windows cert store. To force trust:

Launch Chrome with --unsafely-treat-insecure-origin-as-secure="http://localhost:8866" --user-data-dir=/tmp/fiddler-chrome (for local dev), or
Use chrome://flags/#allow-insecure-localhost → Enable → Relaunch.

For production-like testing, stick with Firefox or Safari — both honor OS-level trust natively.

Best Practices for Long-Term Fiddler Reliability

Rotate certificates annually: Fiddler root certs expire after 1 year. Re-export and reinstall before expiry (check validity in Certificate Manager / Keychain Access).
Use separate profiles: Create a dedicated Chrome profile (chrome://settings/manageProfile) for Fiddler sessions — avoids mixing pinned domains and reduces risk.
Disable auto-updates during critical debugging: Fiddler updates may reset certificate state. Pause updates via Help → Check for Updates → Disable Auto-Check.
Document your setup: Keep a note of Fiddler version, cert export date, and OS version — invaluable when debugging intermittent https decryption failures across team members.

Conclusion: Certificates Are the Foundation of Reliable Debugging

Installing the Fiddler root certificate correctly transforms Fiddler from a basic HTTP logger into a full-fledged https decryption powerhouse — enabling deep inspection of headers, cookies, JWTs, encrypted payloads, and TLS negotiation details. Whether you’re troubleshooting CORS issues, validating OAuth token lifetimes, or auditing API security headers, proper certificate trust is the gatekeeper to meaningful fiddler debugging.

Remember: The steps differ meaningfully between Windows and macOS — especially around trust enforcement and keychain handling. Skipping trust configuration on macOS or ignoring SmartScreen prompts on Windows leads directly to red tunnel sessions and false negatives. Treat certificate setup not as a one-time chore, but as part of your core fiddler tutorial toolkit.

For more advanced scenarios — like capturing traffic from iOS simulators, Android devices, or .NET Core apps with custom HttpClient handlers — explore our more tutorials or dive deeper into the browse HTTP/HTTPS Capture tutorials section. And if you hit an edge case not covered here, contact us — we’ll help you trace it down.

Bonus: Quick Validation Checklist

✅ Fiddler is running and HTTPS decryption is toggled ON. ✅ Root certificate installed in Trusted Root Certification Authorities (Windows) or System keychain with Always Trust (macOS). ✅ Browser/app proxy points to 127.0.0.1:8866 (Fiddler Everywhere) or 127.0.0.1:8888 (Classic). ✅ Test domain (https://httpbin.org) shows green HTTPS sessions with readable request/response bodies. ✅ No certificate warnings in browser UI or Fiddler’s status bar.

Master this once — and every subsequent http debugging session becomes faster, clearer, and more trustworthy.