Using Fiddler to capture API-NG HTTPS requests

[[Adam]]

Is anyone using Fiddler successfully to capture requests and responses from their Java application to API-NG?

If so, could you share your configuration?

I've switched on "Decrypt HTTPS traffic" in the Fiddler config, then imported the root certificate successfully using the command:

keytool.exe -import -file FiddlerRoot.cer -keystore FiddlerKeyStore -alias Fiddler

Then I set the JVM options as follows:

-DproxySet=true

-DproxyHost=127.0.0.1

-DproxyPort=8888

-Djavax.net.ssl.trustStore=<path\to\FiddlerKeystore >

-Djavax.net.ssl.trustStorePassword=<Keystore Password>

The error I'm getting when I try and run my application is:

"javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderE xception: unable to find valid certification path to requested target"

[Grantay.]

Using Fiddler

I am not sure if this will help you or not...

For what it is worth, there is a new version of Fiddler I installed a few days ago - though I am not using Java I can capture the json messages and inspect them.

If you use Windows you need to enable inspection of their app containers - the instructions are listed in the new version.

[[Adam]]

Thanks for the suggestion Grantay. I upgraded to the new version too when I started trying to get this working but unfortunately it didn't solve the problem...

[jptrader]

I have no problems using Fiddler to capture API-NG traffic. And I have not imported any certificate to Fiddler. The trick that works for me is to start Fiddler after my application has logged in. Not using Java though.

[[Adam]]

OK I've found that if I set up Fiddler to capture HTTPS connects but not to decrypt them, I can at least see the requests going back and forth.

That's good enough for now as I mainly wanted to monitor performance. I'll revisit the decryption issue another time!

[[Adam]]

I just sussed it. Instead of creating a new keystore ("FiddlerKeyStore" in my original post), I should have imported the Fiddler root certificate into the Java CA store ("cacerts") instead.

Now I can see all decrypted HTTPS requests.