proxyman-https-capture

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Proxyman HTTPS Capture

Proxyman HTTPS 抓包

Choose the least invasive working capture path for the user's exact device, runtime, network, and Proxyman platform. Normal proxy capture has three independent requirements: route traffic through Proxyman, trust the Proxyman CA, and enable SSL Proxying for the target host. Atlantis is an instrumentation alternative that forwards inspected traffic to Proxyman without that proxy/CA/SSL-Proxying path; apply its separate limits and verification.

Use

proxyman-mcp-setup

if tools are absent,

proxyman-traffic-debugging

to inspect captured flows,

proxyman-certificates-recovery

for the host Mac's generated/custom root lifecycle or custom server/client identities, and

proxyman-debugging-tools

when current official documentation is needed beyond the setup flow.

根据用户的确切设备、运行时、网络和 Proxyman 平台，选择侵入性最低且可行的抓包路径。普通代理抓包有三个相互独立的要求：将流量路由到 Proxyman、信任 Proxyman CA，以及为目标主机启用 SSL Proxying。Atlantis 是一种插桩替代方案，可将经过检查的流量转发到 Proxyman，而无需采用上述代理/CA/SSL Proxying 路径；应遵循其独立的限制和验证方式。

如果缺少相关工具，请使用

proxyman-mcp-setup

；要检查已捕获的流量，请使用

proxyman-traffic-debugging

；要管理主机 Mac 上生成或自定义根证书的生命周期，以及自定义服务器/客户端身份，请使用

proxyman-certificates-recovery

；当设置流程之外需要当前官方文档时，请使用

proxyman-debugging-tools

。

Gather The Minimum Context

收集最少必要上下文

Establish:

host OS running Proxyman and app version;
target type, OS/runtime version, physical vs simulator/emulator, and debug vs production build;
how the target connects to the host and whether a VPN, MDM, firewall, proxy, or certificate pinning is present;
target hostname and whether HTTP is visible but HTTPS is opaque, or no traffic appears at all;
whether the user wants GUI steps, MCP-guided automation, or manual commands.

Do not install certificates, root an emulator, alter system proxy, inject a shell/app, or restart a target until the user approves that action.

确认：

运行 Proxyman 的主机 OS 及应用版本；
目标类型、OS/运行时版本、真机还是模拟器/仿真器，以及调试还是生产构建；
目标如何连接到主机，以及是否存在 VPN、MDM、防火墙、代理或证书锁定；
目标主机名，以及是能够看到 HTTP 但 HTTPS 内容不可读，还是完全没有流量出现；
用户需要 GUI 步骤、MCP 引导式自动化还是手动命令。

在获得用户批准前，不要安装证书、对模拟器进行 root、修改系统代理、注入 shell/应用或重启目标。

Universal Capture Model

通用抓包模型

Diagnose in this order:

Reachability: target can reach the host running Proxyman.
Routing: target sends HTTP/HTTPS to Proxyman's current proxy host and port.
Recording: Proxyman is recording and the source/client is visible.
Trust: target trusts the correct Proxyman root CA in the relevant store.
SSL Proxying: target host is included and not excluded.
Application behavior: library proxy bypass, localhost special case, VPN, pinning, QUIC/HTTP3, or a custom trust store.

Do not treat certificate installation as proof that routing works, or SSL Proxying as proof that the target trusts the CA.

按以下顺序诊断：

可达性： 目标能够访问运行 Proxyman 的主机。
路由： 目标将 HTTP/HTTPS 流量发送到 Proxyman 当前的代理主机和端口。
录制： Proxyman 正在录制，并且可以看到流量来源/客户端。
信任： 目标在相关存储中信任正确的 Proxyman 根 CA。
SSL Proxying： 目标主机已包含在 SSL Proxying 中，且未被排除。
应用行为： 存在库级代理绕过、localhost 特殊情况、VPN、证书锁定、QUIC/HTTP3 或自定义信任存储等因素。

不要将安装证书视为路由正常的证据，也不要将启用 SSL Proxying 视为目标信任 CA 的证据。

Choose A Path

选择路径

Read capture paths for the decision matrix and official page links. Read Atlantis capture when the user asks what Atlantis is, needs capture while a VPN blocks the normal proxy, or wants to integrate Atlantis into an app.

Desktop browser/app honoring system proxy: use system proxy plus host certificate trust.
iOS/iPadOS/Vision Pro device: use Wi-Fi manual proxy and device certificate trust; for a supported app that can include an instrumentation library, consider Atlantis when proxy/certificate setup is undesirable or a VPN blocks the normal route.
Apple simulator: install the CA into the booted simulator and use the simulator proxy path.
tvOS/watchOS: follow the physical/simulator-specific official path.
Android physical device: manual Wi-Fi proxy plus user/system CA strategy appropriate to OS and app policy.
Android emulator: prefer Proxyman's guided automation for an active compatible AVD; read Android emulator safety.
Terminal runtime or browser: prefer Automatic Setup/injection when supported; otherwise use explicit proxy variables/options and the runtime CA bundle/store from runtime capture.
Localhost: use explicit proxy configuration or Reverse Proxy; many clients intentionally bypass the system proxy.
Docker/VM/subsystem: use the host address reachable from that network namespace, not blindly
```
127.0.0.1
```
.

阅读抓包路径，了解决策矩阵和官方页面链接。当用户询问 Atlantis 是什么、VPN 阻止普通代理导致无法抓包，或希望将 Atlantis 集成到应用中时，阅读 Atlantis 抓包。

遵循系统代理的桌面浏览器/应用：使用系统代理并信任主机证书。
iOS/iPadOS/Vision Pro 设备：通过 Wi-Fi 手动代理并设置设备证书信任；对于支持且可包含插桩库的应用，如果不想进行代理/证书设置，或 VPN 阻止普通代理路径，可考虑 Atlantis。
Apple 模拟器：将 CA 安装到已启动的模拟器中，并使用模拟器代理路径。
tvOS/watchOS：遵循真机或模拟器对应的官方路径。
Android 真机：手动设置 Wi-Fi 代理，并采用适合 OS 和应用策略的用户 CA/系统 CA 策略。
Android 模拟器：对于正在运行且兼容的 AVD，优先使用 Proxyman 的引导式自动化；阅读 Android 模拟器安全注意事项。
终端运行时或浏览器：受支持时优先使用 Automatic Setup/注入；否则按照运行时抓包中的说明，使用显式代理变量/选项以及运行时 CA bundle/store。
Localhost：使用显式代理配置或 Reverse Proxy；许多客户端会故意绕过系统代理。
Docker/VM/subsystem：使用从对应网络命名空间可访问的主机地址，不要盲目使用
```
127.0.0.1
```
。

MCP-Guided Workflow

MCP 引导式工作流

```
get_version
```
and
```
get_proxy_status
```
.
```
answer_setup_question
```
with the exact target, platform, runtime, VPN, and symptom.
Read the returned citations and use
```
list_setup_workflows
```
when the target is ambiguous.
For a normal proxy path, check
```
get_certificate_status
```
and
```
get_ssl_proxying_list
```
. For Atlantis, read
```
docs://setup/atlantis
```
and do not force certificate or SSL Proxying setup.
Use a relevant built-in resource or prompt. Setup resources are listed in the capture-path reference.
Explain the automation's state changes and request consent.
Use
```
run_guided_setup
```
,
```
inject_terminal
```
,
```
inject_electron
```
,
```
set_system_proxy
```
,
```
install_certificate
```
, or SSL tools only when the live server exposes the needed action and the user approved it.
Generate one known HTTPS request from the target.
Find it with
```
filter_flows
```
using host and, when relevant,
```
client
```
; inspect it with
```
get_flow_detail
```
.
Verify HTTPS body visibility, TLS/certificate summary, and target identity.

If the MCP setup index has no exact match, fetch the current official page through

proxyman-debugging-tools

rather than forcing a generic fallback result.

调用
```
get_version
```
和
```
get_proxy_status
```
。
使用
```
answer_setup_question
```
，并提供准确的目标、平台、运行时、VPN 和症状。
阅读返回的引用；当目标不明确时，使用
```
list_setup_workflows
```
。
对于普通代理路径，检查
```
get_certificate_status
```
和
```
get_ssl_proxying_list
```
。对于 Atlantis，阅读
```
docs://setup/atlantis
```
，不要强制进行证书或 SSL Proxying 设置。
使用相关内置资源或提示词。设置资源列于抓包路径参考文档中。
说明自动化操作将改变的状态，并征得用户同意。
仅当实时服务器提供所需操作且用户已经批准时，才使用
```
run_guided_setup
```
、
```
inject_terminal
```
、
```
inject_electron
```
、
```
set_system_proxy
```
、
```
install_certificate
```
或 SSL 工具。
从目标生成一个已知的 HTTPS 请求。
使用主机名以及相关情况下的
```
client
```
参数，通过
```
filter_flows
```
查找请求，再使用
```
get_flow_detail
```
检查其详情。
验证 HTTPS 正文是否可见，并检查 TLS/证书摘要和目标身份。

如果 MCP 设置索引中没有精确匹配项，应通过

proxyman-debugging-tools

获取当前官方页面，不要强行套用通用兜底结果。

GUI Workflow

GUI 工作流

Open Proxyman's Setup or Certificate guide for a normal proxy target. For Atlantis, follow the dedicated integration reference instead.
Use the proxy host/port shown by the running app; do not hardcode a common port.
Follow the target-specific routing and certificate steps from the current official page.
Enable SSL Proxying only for the required host or wildcard.
Generate a deterministic request and verify it in Proxyman.
Document how to restore proxy, trust, emulator boot image, or injected environment.

对于普通代理目标，打开 Proxyman 的设置（Setup）或证书（Certificate）指南。对于 Atlantis，请遵循专门的集成参考文档。
使用当前运行应用所显示的代理主机/端口，不要硬编码常见端口。
按照当前官方页面中针对具体目标的路由和证书步骤进行操作。
仅为所需主机或通配符启用 SSL Proxying。
生成一个确定性请求，并在 Proxyman 中验证。
记录如何恢复代理、信任设置、模拟器启动镜像或注入环境。

Failure Triage

故障排查

Nothing appears: recording/routing/reachability/client-source problem.
HTTP appears, HTTPS does not: routing works; inspect target trust, SSL Proxying, pinning, HTTP3/QUIC, or custom CA stores.
TLS error: verify the correct CA, full trust, host include/exclude, app pinning, and date/time. Do not disable TLS verification as the default fix.
Only some libraries missing: the library likely bypasses environment/system proxy or uses a separate trust store.
Device cannot connect: verify same network or routable host address, firewall/access control, current port, and VPN/Private Relay behavior.
Localhost missing: use Reverse Proxy or explicit proxy settings with a non-loopback target address.
VPN conflict on iOS: read the Atlantis decision path for a build the user controls instead of repeatedly changing the device proxy.
Android app rejects user CA: use a debug network security configuration or a controlled compatible emulator system-CA path. Do not advise bypassing pinning in a production app.

没有任何流量出现： 存在录制、路由、可达性或客户端来源问题。
出现 HTTP，但没有 HTTPS： 路由正常；请检查目标信任、SSL Proxying、证书锁定、HTTP3/QUIC 或自定义 CA 存储。
TLS 错误： 验证正确的 CA、完全信任、主机包含/排除规则、应用证书锁定以及日期/时间。不要默认通过禁用 TLS 验证来修复。
仅缺少某些库的流量： 该库可能绕过了环境/系统代理，或使用了单独的信任存储。
设备无法连接： 验证是否处于同一网络或使用可路由的主机地址，并检查防火墙/访问控制、当前端口以及 VPN/Private Relay 行为。
缺少 Localhost 流量： 使用 Reverse Proxy，或使用非环回目标地址配置显式代理。
iOS 上存在 VPN 冲突： 对于用户可控的构建版本，阅读 Atlantis 决策路径，不要反复更改设备代理。
Android 应用拒绝用户 CA： 使用调试网络安全配置，或在兼容模拟器中采用受控的系统 CA 路径。不要建议在生产应用中绕过证书锁定。

Verification Checklist

验证清单

A setup is complete only when:

the expected target/client is identifiable;
the test request and response appear;
HTTPS headers/body are readable through the intended path: decrypted for normal proxy capture or forwarded by the expected Atlantis source;
no unrelated hosts were unnecessarily enabled for SSL Proxying when the normal proxy path was used;
the user knows the rollback path;
limitations such as pinning, production builds, VPN, root/Magisk, or unsupported automation are stated.

只有满足以下条件，设置才算完成：

能够识别预期的目标/客户端；
测试请求和响应均已出现；
可通过预期路径读取 HTTPS 标头/正文：普通代理抓包时已解密，或由预期的 Atlantis 来源转发；
使用普通代理路径时，未不必要地为无关主机启用 SSL Proxying；
用户了解回滚方式；
已说明证书锁定、生产构建、VPN、root/Magisk 或不支持的自动化等限制。