A phone's browser works with Mittelware as soon as you've set the proxy and installed the certificate. A native app is stricter, because the app decides what it trusts. If you're building the app, you can tell it to trust Mittelware in debug builds only, and your release builds stay as safe as before.

First do the steps in Phones and other devices: turn on Allow other devices, set the proxy and install the certificate on the device. Then pick your stack.

Android (Kotlin, Java, React Native)#

An Android app, including one built with React Native, ignores certificates you installed unless it opts in. Add a network security config that applies to debug builds only:

1. Create app/src/debug/res/xml/network_security_config.xml:

   <?xml version="1.0" encoding="utf-8"?>
   <network-security-config>
     <debug-overrides>
       <trust-anchors>
         <certificates src="user" />
       </trust-anchors>
     </debug-overrides>
   </network-security-config>

2. Point your app at it. In app/src/debug/AndroidManifest.xml:

   <manifest xmlns:android="http://schemas.android.com/apk/res/android">
     <application android:networkSecurityConfig="@xml/network_security_config" />
   </manifest>

debug-overrides only takes effect when the app is debuggable, so a release build keeps Android's normal rules.

Standard HTTP libraries (OkHttp, HttpURLConnection, React Native's networking) follow the Wi-Fi proxy on their own, so no code change is needed for that.

If the certificate shouldn't be installed on the phone#

Put the file in your project instead. Download Mittelware-CA.pem from the setup page, save it as app/src/debug/res/raw/mittelware_ca.pem, and trust it in the config:

<debug-overrides>
  <trust-anchors>
    <certificates src="@raw/mittelware_ca" />
  </trust-anchors>
</debug-overrides>

Certificate pinning#

If the app pins its server's certificate (OkHttp's CertificatePinner, or a <pin-set> in the security config), Mittelware's certificate is rejected. Turn the pinning off in debug builds.

Flutter#

Flutter's networking ignores both the Wi-Fi proxy and the user certificate store, so it needs two changes in code that only runs in debug.

import 'dart:io';
import 'package:flutter/foundation.dart';

HttpClient debugHttpClient() {
  final client = HttpClient();
  if (kDebugMode) {
    // Send traffic to Mittelware: use your computer's address and the port shown in Mittelware.
    client.findProxy = (uri) => 'PROXY 192.168.0.119:8081';
    // Accept Mittelware's certificate (debug builds only!).
    client.badCertificateCallback = (cert, host, port) => true;
  }
  return client;
}

With the dio package, set the same two properties on its IOHttpClientAdapter (createHttpClient). Keep badCertificateCallback out of release builds: it switches off certificate checking altogether.

iOS apps (Swift, Objective-C, React Native)#

Nothing in code. Once the device's Wi-Fi proxy is set and Mittelware CA is switched on under Certificate Trust Settings (steps), traffic from URLSession and from libraries built on it shows up.

The exception is an app that pins certificates. Turn the pinning off in debug builds.

Emulators and simulators#

You don't need a physical device.

• Android Emulator: open Extended controls, Settings, Proxy, switch off Use Android Studio HTTP proxy settings, choose Manual, and enter your computer's address and Mittelware's port. Install the certificate inside the emulator the same way as on a phone. Enable Allow other devices first.
• iOS Simulator: it uses your Mac's own network settings. Turn on System proxy in Mittelware's Settings, and trust the certificate on the Mac. Then drag the certificate onto the simulator window to install it there, and enable it under Certificate Trust Settings.

Still not showing?#

Check, in this order:

1. The device shows as Connected in Mittelware's Connect a device panel. If not, its proxy isn't set or can't reach your computer.
2. Plain HTTP requests from the app appear, but HTTPS ones don't: the certificate isn't trusted by the app. Re-check the steps for your stack above.
3. Only some hosts fail: those may be pinned. Put them on the bypass list if you only need the rest to work.