Example of a custom CA certificate for Charles Proxy

Charles Proxy, like Fiddler under Windows, can view HTTPS traffic, but when you check HTTPS requests using the CA certificate provided by Charles, the following error occurs on Firefox 35 Web page:
Twitter.com uses a invalid security certificate. The certificate is not trusted because the issuer certificate has. (Error code:sec_error_expired_issuer_certificate)
The reason is said to be this:

The more recent versions's Firefox only allow certs with start dates after the Unix epoch (1st 1970). As the Charles CA cert has a start year of 1899 it ' s seen as expired.
The latest version of Firefox only allows the certificate to start at 1970, while the Charles CA certificate starts at 1899.
The solution is to build a certificate yourself.

Self-built CA certificate

My process is based on the OpenSUSE 13.2 operating system.
Execute the following command line by row (Administrator rights are required under OpenSUSE).

Mkdir-p/usr/local/charlesca
Cd/usr/local/charlesca
mkdir certs Private Newcerts
echo > Serial
Touch Index.txt

Build CA Certificate

OpenSSL req-new-x509-days 3650-extensions V3_ca
-keyout Private/ca_key.pem-out Certs/ca_cert.pem
-config/etc/ssl/openssl.cnf

Please note the path after-config, this is my OpenSUSE openssl.cnf file path, please confirm its path according to your operating system.

This step will also require the completion of passphrase and other information, passphrase will be used later in Charles.
Convert to PKCS12 format
Because Charles needs a certificate in PKCS12 format, a conversion is needed:
OpenSSL pkcs12-export-out Ca_cert.pfx-inkey private/ca_key.pem-in Certs/ca_cert.pem
In this way, the ca_cert.pfx file is generated in the/usr/local/charlesca directory.
We have a total of 3 important documents:

Ca_cert.pfx–charles to add custom certificates
Ca_cert.pem– is provided to clients using the
ca_key.pem– Key (Please make sure it's safe)

Configure Charles
Open Charles-> proxy-> proxy Settings ... Menu
Click on the SSL tab page

Tick ' Use a custom CA certificate '
Click CHOOSE button to select/usr/local/charlesca/ca_cert.pfx file
This will be a good way to configure Charles's certificate.

Import Certificate to Firefox

Open Firefox-> Preferences
Select Advanced-> Certificates label page
Click VIEW certificates
Click IMPORT ...

Navigate to/usr/local/charlesca/certs/ca_cert.pem File
Tick ' This certificate can identify websites '
Confirm
The last time you restart Charles, you will be able to play the window required to fill in the passphrase set when the certificate was created. After that, HTTPS traffic can be analyzed normally.