HTTPS Inspection on iOS: Install and Trust the NetPeek MITM CA

To inspect HTTPS plaintext on iOS, download NetPeek's locally generated CA profile, install it under VPN & Device Management, explicitly enable full trust under Certificate Trust Settings, and add the debug target to the MITM host list.

2Decrypt HTTPS (install the certificate)

To read HTTPS content you must install and trust the CA certificate NetPeek generates on-device. You do this manually — iOS forces the step through Settings.

After starting capture, open the certificate page at http://127.0.0.1:8080 in a browser and download the profile.
Go to Settings → General → VPN & Device Management and install the profile.
Then Settings → General → About → Certificate Trust Settings and enable full trust for the NetPeek certificate.
Add the domains you want to decrypt to the MITM host list (section 9).

The certificate is only for on-device debugging and is never uploaded. Upstream certificate verification is fail-open by default (it won't break connectivity on cert issues), so you can debug misconfigured servers.

9MITM host list

For performance and stability, NetPeek only decrypts (MITM) the domains you specify; the rest pass through transparently. The list supports wildcards:

+host / a bare host = decrypt that host; * = decrypt everything.
-*host* = explicitly do not decrypt (blacklist, higher priority than wildcards).
Swipe a row → "Add MITM / Add MITM blacklist" to maintain it quickly.

The app's own backend (control-plane) domain is always forced direct, never decrypted, and never written to the capture database — a safety red line.

FAQ

Can NetPeek trust the certificate automatically?

No. iOS requires the user to install the profile and explicitly enable full trust in Settings; NetPeek cannot bypass that consent step.

Is the CA certificate uploaded?

No. It is generated on the device and used only for the HTTPS debugging you enable.

Why is HTTPS still not readable after trust is enabled?

Add the target host to the MITM host list and make a new request. Existing capture records are not retroactively decrypted.