Module cert_cache 

Certificate cache for MITM proxy

Generates and caches per-domain leaf certificates signed by a CA certificate. This allows the proxy to present valid-looking certificates for any domain when performing TLS Man-in-the-Middle interception.

Where the CA comes from, and what touches the disk

The CA is generated fresh in memory every time a proxy server is started (CertificateMode::Generate). There is no fixed or hardcoded key, nothing is read from a well-known path, and neither the CA key, the per-domain leaf keys, nor any intercepted plaintext is ever written to disk by this module. Stopping the server discards the CA, so a client that trusted one run’s CA will reject the next run’s.

The only way a CA certificate reaches the filesystem is when the operator explicitly passes the ca_export_path startup parameter, which writes the CA certificate (public, safe to distribute) and never the private key.

Interception only works for clients that have been told to trust that CA, so this cannot silently intercept an unmodified client: without the trust grant the TLS handshake fails at the client with an unknown-issuer error.

Structs

CacheStats

Certificate cache statistics

CertificateCache

Certificate cache for dynamically generated leaf certificates

Constants

MAX_CACHED_CERTIFICATES

Bound retained leaf certificates and private keys independently of connection count. One peer can request arbitrarily many distinct hosts over the cache’s 24-hour TTL. Eviction only affects future handshakes; active sessions own their certificate copy.