Fiddler Usage With Secure Database

• Fiddler is a debugging tool that sits between an application and a server so you can read the HTTPS traffic that flows between them.

• To use Fiddler against a secure RavenDB server, you need to configure both sides of the connection that Fiddler intercepts.
  Fiddler must present a valid client certificate when it forwards a request to the server, and the client must accept the certificate that Fiddler presents in place of the server's real one.

• In this page:

  • Forward the client certificate to the server
    • Option A: Add a FiddlerScript snippet
    • Option B: Place the .CER file in the Fiddler profile
  • Accept the proxy certificate at the client
    • Option 1: Trust the Fiddler root certificate in Windows
    • Option 2: Trust the proxy certificate via the client API

Forward the client certificate to the server

To make Fiddler forward a valid client certificate to the server on your behalf, first export your certificate to a .CER file:

1. Open Manage User Certificates.
2. Right-click the certificate in the Personal Certificates store.
3. Click All Tasks > Export and save the .CER file.

Then point Fiddler at the file using one of the two options below.

Option A: Add a FiddlerScript snippet

In Fiddler, add the following line to the OnBeforeRequest function:

oSession["https-Client-Certificate"] = "C:\\test\\someCert.cer";

---

Option B: Place the .CER file in the Fiddler profile

Copy the .CER file to:

%USERPROFILE%\My Documents\Fiddler2\ClientCertificate.cer

The filename must be exactly ClientCertificate.cer.

Note that either option exposes your client certificate to Fiddler.
Use this configuration only on a controlled machine where the Fiddler instance is yours.

Accept the proxy certificate at the client

When Fiddler intercepts a request, it presents its own certificate to the client in place of the server's real certificate.
The client refuses that certificate by default.
You have two ways to make the client accept it.

Option 1: Trust the Fiddler root certificate in Windows

1. In Fiddler, click Tools > Fiddler Options > HTTPS.
2. Check Decrypt HTTPS Traffic.
3. When prompted with Trust the Fiddler Root certificate?, click Yes.
4. When prompted with Do you want to install this certificate?, click Yes.

Note that this makes Windows trust every certificate issued by Fiddler's root authority for as long as the certificate is installed in the trust store.
That trust applies to every process on the machine that uses the Windows trust store, not only to your RavenDB client.
Remove the certificate from the Windows trust store when the debugging session ends.

---

Option 2: Trust the proxy certificate via the client API

In your RavenDB client application code, register a handler on RequestExecutor.RemoteCertificateValidationCallback that returns true for every certificate:

Raven.Client.Http.RequestExecutor.RemoteCertificateValidationCallback +=
    (sender, cert, chain, errors) => true;

This handler accepts the certificate that Fiddler presents.
It also accepts every other certificate the client encounters for as long as the handler is registered, which is why the snippet is appropriate only for a short, controlled debugging session.

Note that this trust-everything form is for debugging only.
While the handler is registered, the client accepts every certificate it receives, with no validation, for as long as the application is running.
Remove the handler when the debugging session ends.
To trust a specific server certificate in production (for example, an expired certificate during renewal, a self-signed development or staging certificate, a hostname mismatch, or a certificate signed by an internal certificate authority), see Trusting a Server Certificate instead.