Not completely certain if it's better to post here or security, so, trying here first.

I'm currently attempting to test a new feature in a desktop application that uses 2 way pinning for https traffic. If the client certificate (built into the application) is not one that's expected, the server will return an error.

Normally, running something like Fiddler would be fine, but, because of the fact that the Fiddler uses it's own, we can not see the traffic coming back.

Is there a way in Fiddler to import a certificate that I haven't managed to find yet, or, is there another way to inspect this traffic?


1 Answer 1


If you haven't already looked into it you can register client certificates as mentioned http://docs.telerik.com/fiddler/configure-fiddler/tasks/RespondWithClientCert

You can also utilize Soapui to send communications with certificates, but that's just services...not sure if this is a service or part of the webapp...sounds like it's coded in the app.

If all else fails you can utilize wireshark to pull all the traffic out and from there try to filter for the specific traffic you are looking for and see that it is communicating as expected.

  • Unfortunately, it seems as though I'm not going to be able to test this until next week now, but, the fiddler solution appears as though it should work. Going to try to find another scenario like this to try it out before. Commented Aug 15, 2014 at 18:22
  • The fiddler solution does certainly work. Thanks! Commented Aug 19, 2014 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.