Expose project-scoped private-CA trust for Proxy, Repeater, and Intruder

Open
  • Is something wrong?
#179 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
45/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
backend, security

Research direction

Start with app/proxy_control.rs, app/repeater.rs::ensure_repeater, app/intruder/controller.rs, and proxy/tls.rs to trace where upstream trust roots are passed and built. Use synthetic traffic and local TLS tests to check the listed acceptance cases across Proxy, Repeater, and Intruder. Done means project-scoped CA import, listing, removal, and persistence work with hostname verification enabled, and the testing and removal steps are documented.

Written by the indexing model from the issue text.

Description

enhancement focus: community parity focus: usability priority: p2

Review baseline

Source review of main at 47e7fce3106584f4f333db4eada6dcd0c33c8bbe (2026-11-05), including unified history (#169). This is not a native-app runtime reproduction. Use synthetic traffic for tests and issue evidence.

Workflow gap and evidence

Private-CA labs/internal applications cannot be configured through the desktop trust UI. The transport supports extra_roots_pem, but app/proxy_control.rs, app/repeater.rs::ensure_repeater, and app/intruder/controller.rs pass empty vectors. proxy/tls.rs builds upstream verification roots separately from Perseid's interception CA.

Acceptance criteria

  • Import/list/remove additional upstream CA certificates for the active project; show certificate subjects/fingerprints and useful PEM validation errors.
  • Apply a consistent trust policy to proxied HTTPS and direct Repeater/Intruder sends, rebuilding relevant clients safely on change.
  • Keep hostname and certificate verification enabled; importing a root must not enable global insecure TLS or modify OS/browser trust.
  • Distinguish upstream trust anchors from Perseid's interception CA/key in the UI/docs.
  • Persist only the intended trust configuration with compatible project defaults; switching projects cannot retain another project's added trust.
  • Local TLS tests cover private CA accepted after import, unknown CA rejected, hostname mismatch rejected, root removal, and project switch across all three tools.
  • Document how to test internal HTTPS targets and how to remove trust.

Non-goals: mTLS client identities, upstream HTTP/SOCKS routing, or arbitrary SNI overrides; these need separate designs.

Dominant language
Rust
Stars
1
Forks
0
Avg merge
1h 12m
Merged PRs (30d)
137

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from andyintheshell/perseid

All issues in andyintheshell/perseid

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.