If I understand the question, the traffic in your local intranet will basically always be encrypted with your root cert. So client -> proxy with your cert, then normal internet encryption from proxy -> internet.
For the apps, it depends on the app, but you can usually insert your cert into their store, it might just be different than the systems store. This could be hard to do on an non-rooted iPhone, idk. My experience is with Linux desktops. For example, in chromium based apps, there is a database in ~/.pki/nssdb that you can insert your cert into. Again, this is something I do at work where we have a very tightly controlled network and application stack. I would not recommend a MiTM proxy for your home environment, it will only cause headaches.
MigratingtoLemmy@lemmy.world 11 months ago
Ah, I see. I suppose I got a bit confused, and wanted to confirm how encryption would work for outbound traffic. Just to be sure: when an application wants to send encrypted data to a website/service on the Internet, it will use the respective certificate for said website. However, if one runs a transparent proxy in the middle and inserts a root certificate in the certificate store of the application, said certificate becomes valid (and the de-facto pick) for all websites, and this is what the client begins to use for everything.
Is that how it works?
canni@lemmy.one 11 months ago
Not quite. This might be a better explanation than I’m providing: chat.openai.com/…/c77fc7ed-9d68-4076-ab70-e953a38…
MigratingtoLemmy@lemmy.world 11 months ago
Indeed, that is what I meant to say. Thanks for the link. I’m assuming that transparent proxies have some sort of certificate store in them, since they connect as the user to different websites?