Professional debugging of mobile applications is impossible without understanding what network traffic the device generates. The tool Charles Proxy has become a de facto standard for developers and testers, allowing you to intercept, analyze and modify HTTP and HTTPS requests. However, simply running the app on a computer is not enough - you need to correctly configure the connection between the PC and the mobile device.
The setup process may seem confusing due to the security requirements in modern versions Android, starting from 7.0 and higher. The system strictly controls the installation of user certificates, which creates additional barriers to intercepting encrypted traffic. In this article, we will analyze each connection step, from setting the IP address to installing the root certificate, so that you can fully use the capabilities of the sniffer.
The correct configuration of the environment will allow you to see the structure of JSON responses, analyze network latency and find errors in the API. Let's move on to the technical implementation to turn your smartphone into a powerful debugging tool.
Preparing the working environment and setting up Charles Proxy
Before you try to connect devices, you need to make sure that the proxy server itself on your computer is configured correctly. By default Charles Proxy listens to port 8888, but this parameter can be changed in the app settings. Make sure the option Proxy → SSL Proxying Settings Activated if you plan to work with HTTPS traffic.
A critical point is allowing incoming connections from the local network. A rule must be added to the menu Proxy → Access Control Settings to allow connections for your subnet. Without this step, the smartphone simply will not be able to “see” the computer on the network, even if they are on the same Wi-Fi access point.
It is also worth checking whether the operating system firewall is blocking incoming connections to the selected port. Often antiviruses or built-in protections of Windows and macOS prevent the work of proxy servers, considering them suspicious activity.
⚠️ Attention: Never use public Wi-Fi networks to debug traffic. In such networks, your computer and application data can become accessible to attackers, since the proxy server opens ports for external access.
Use a static IP address for your computer on the local network. If the router issues a new address after a reboot, you will have to reconfigure the proxy on all connected devices.
Setting up a network connection on an Android device
For a successful connection, both devices must be on the same local network. Most often this means connecting to the same Wi-Fi router. If your computer is connected via cable and your phone via Wi-Fi, make sure that they are on the same subnet and Client Isolation is disabled on the router.
First, find out the IP address of your computer. In Windows, this is done through the command ipconfig in the command line, and in macOS or Linux - through ifconfig or ip addr. You need an address that usually starts with 192.168.x.x.
Next, go to the smartphone settings. Go to the Settings → Wi-Fi section and click on the name of your current network (or hold your finger to bring up the modification menu). You need to change the proxy settings from “No” to “Manual”.
In the window that opens, enter the computer’s IP address in the “Proxy server host name” field and the port (8888 by default) in the appropriate field. Save your changes. Now all device traffic should try to go through your computer.
- 📡 Make sure that there are no extra spaces or characters in the proxy field.
- 🔒 Check that the computer firewall is not blocking port 8888.
- 🔄 If the Internet on the phone has disappeared, then the computer is not allowing traffic further.
Installing and trusting the Charles SSL certificate
The most difficult stage is working with encrypted traffic. Without installing a certificate, you will only see domain names in requests, but the contents of the packages will be hidden. In the Charles app window, go to menu Help → SSL Proxying → Install Charles Root Certificate.
On your Android device, you will be prompted to install the certificate. In older versions of the system this happened quickly, but modern versions require confirmation of the action by entering a PIN code or screen unlock pattern. This is a security measure that prevents the hidden installation of malicious certificates.
After installation, the certificate goes to the user certificate store. However, this is not enough to work with HTTPS in most applications. You must explicitly tell the system that you trust this certificate to authenticate connections.
Settings → Security → Encryption and Credentials → Trusted Credentials → UserLocate the certificate named Charles Proxy... in the list and make sure it is active. If the certificate icon is gray or crossed out, the traffic will not be decrypted.
⚠️ Attention: Starting with Android 7.0, applications do not trust user certificates by default. To debug HTTPS in such applications, you need either rooting the device or a special configuration of the application itself (network security config).
Why is HTTPS not decrypted?
Even with a certificate installed, some applications use the SSL Pinning technique, hard-wired the expected certificate into the code. You can only get around this using tools like Frida or modifying the APK.
Features of working with Android 11 and later
In the latest versions of the mobile operating system, Google has tightened its security policy. User certificates can now only be installed through a special settings interface, and not just by clicking on a file. In addition, the validity period of such certificates is limited to one year.
To install a certificate on Android 11+, the file must be renamed by adding the extension .crtand placed in the root of the internal storage. Then, in the security settings, select the option to install from storage. The system will scan the file and offer to install it.
If you are engaged in professional development, you may need to transfer the certificate to the system storage. This gives applications the ability to trust it by default, like the system's root certificate authorities.
| Android version | Installation method | Application trust | Restrictions |
|---|---|---|---|
| 6.0 - 9.0 | Direct installation file | Custom | Minimal |
| 10 - 11 | Through the settings menu | Custom | Requires PIN code |
| 12+ | Via menu settings | System only* | Root required |
| 13+ | Limited installation | Limited | Strict control |
*The application must explicitly allow user certificates in the manifest, otherwise the traffic will remain encrypted.
On Android 12 and higher without root access, debugging HTTPS traffic of most third-party applications is impossible due to security restrictions.
Setting up SSL Proxying for specific domains
Even after installing the certificate, Charles will not automatically decrypt all traffic. This is done for performance and security. You need to explicitly specify which hosts are subject to inspection. To do this, open Proxy → SSL Proxying Settings.
In the Include tab, add new rules. Usually it is enough to add an entry with host * and port 443to intercept all HTTPS traffic. However, for targeted debugging, it is better to specify specific domains, for example api.example.com.
If you do not add a domain to this list, you will see a request in the Charles interface, but when you try to open its contents, you will receive a connection error or encrypted data. Make sure that the checkbox Enable SSL Proxying is active in the main app window.
- 🎯 Add only the necessary domains so as not to clutter the log with unnecessary traffic.
- 🛡 Use the wildcard symbol
*for subdomains, if there are any a lot. - ⚙ Do not forget to apply the settings with the OK button before checking.
Sometimes you need to restart the session in Charles (Session → Restart Session) for the new rules to apply to already established connections.
⚠️ Attention: app interfaces and settings menus may differ slightly depending on the version of Charles Proxy. Always check the official documentation if you cannot find the menu item you need.
Solving common connection problems
A common problem is the “No Internet” status on the phone when the proxy is enabled. This means that Charles receives packets, but does not forward them further onto the Internet. Check your settings Proxy → macOS Proxy (or Windows Proxy) so that the computer itself also works through a proxy, if necessary, or make sure that the gateway is configured correctly.
Another common error is SSLHandshakeException in the application logs. This indicates that the application has rejected the Charles certificate. In this case, check whether the domain is added to the SSL Proxying settings and whether the certificate is installed on the system.
If traffic is flowing but empty, data compression may be enabled in the browser or application. Try disabling the option Tools → No Caching or check the compression settings in the application itself.
☑️ Connection diagnostics
Frequently asked questions (FAQ)
Why does Charles not see traffic from a specific application?
Most likely, the application uses technology SSL Pinning. It checks the server's certificate against the "fingerprint" hardcoded into the code and rejects the Charles certificate. Bypass requires the use of additional tools, such as Frida or JustTrustMe, and often the presence of root access.
Is it possible to connect Charles via a USB cable instead of Wi-Fi?
Yes, this is a more stable method. You will need to enable USB debugging and forward ports using the command adb reverse tcp:8888 tcp:8888. There is no need to set a proxy in the Wi-Fi settings on your phone; traffic will go through the local interface.
Is it safe to keep the Charles certificate installed?
No. As long as the certificate is active, anyone who gains access to your device or network could theoretically intercept your traffic (for example, passwords from banking applications, if they do not use pinning). After debugging is completed, the certificate must be removed from the security settings.
How to export data from Charles for analysis?
You can save the session in .chx format for later opening in Charles, or export individual requests in HAR, XML or JSON format via the right-click context menu on the request.
Does Charles work with Android emulators Studio?
Yes, emulators usually work through a host proxy automatically. If not, configure the proxy in the emulator manually by specifying IP 10.0.2.2 (special address for accessing the host machine from the emulator) and port 8888.