Allow configuring certain CA details, fixes #5386

[Prinzhorn]

Description

mitmdump --set ca_basename=example --set ca_organization=Example --set ca_common_name=example

So how would I test the "via mitmproxy" part?

Two notes:

1. The onboarding app does not work standalone now, I guess we could do some magic and check for ctx and have it still work but with the default "mitmproxy"?
2. Is there a reason only these two options trigger a new CA? If I understand correctly you can change the confdir at runtime but not other aspects such as key_size?

mitmproxy/mitmproxy/addons/tlsconfig.py

Lines 301 to 303 in af5be0b

	def configure(self, updated):
	if "confdir" not in updated and "certs" not in updated:
	return

Checklist

• I have updated tests where applicable.
• I have added an entry to the CHANGELOG.

[Prinzhorn]

If it actually the basename that is displayed there?

[Prinzhorn]

If it actually the basename that is displayed there?

[roniemartinez]

+1
I need this. Looking forward.

[Prinzhorn]

@roniemartinez I'm curious about your use-case

[roniemartinez]

@Prinzhorn When distributing an app that uses mitmproxy, users are asking why they are downloading a file of another name. I think using Example (via mitmproxy) makes it more clearer to the users.

[mhils]

@roniemartinez: Out of curiosity, could you provide some details on your app? :)

[roniemartinez]

@mhils Sorry but cannot disclose at this moment.

[keeely]

Instead of these options, would it not be better to document how to create our own CA toward the bottom of the page on certs:
https://docs.mitmproxy.org/stable/concepts-certificates/
There is mention of the X509v3 extensions required but, I think an example openssl cfg + command(s) would go some way towards removing this requirement.
Also, if you do go ahead with this, I'd request that you don't add '(via mitmproxy)' this should surely be a choice for the user?

[Prinzhorn]

Instead of these options, would it not be better to document how to create our own CA toward the bottom of the page on certs:
https://docs.mitmproxy.org/stable/concepts-certificates/
There is mention of the X509v3 extensions required but, I think an example openssl cfg + command(s) would go some way towards removing this requirement.

I would prefer to have this integrated, since generating the cert is only 50% of what needs to be done. E.g. I still want the mitm.it cert download links and instructions to work. mitmproxy already contains all the code necessary to generate the certs it needs with the appropriate configuration. I'm shipping mitmproxy as part of a desktop application and I definitely don't want to replicate this logic using sub-processes (cross OS 😱 ) or additional code.

Also, if you do go ahead with this, I'd request that you don't add '(via mitmproxy)' this should surely be a choice for the user?

No, see #5386 (comment) . We don't want to make it trivial to hide the fact that mitmproxy is intercepting the connection.