Best way to intercept/log HTTPS requests?

Question

I'm a software developer who wants to learn how the Github Container Registry API works, so that I can write an alternative client for it. Reading the spec doesn't give me enough answers: there are some things that I can't get working, and yet docker pull works. I want to know why. In order to find out what I'm doing wrong, I want to log all HTTPS requests made by docker pull to Github Container Registry.

What's the best tool that can act as an intermediary and log all HTTPS requests?

• I want to see request and response headers and bodies.
• I also want a tool that's as easy to setup and use as possible, so that I can iterate quickly.
• I've already taken a look at mitmproxy but it looks way too complicated for my purposes.
• Http request logs collector recommends httpry, but I need HTTPS support.

Answer 1

If the docker tool does not implement certificate pinning a proxy like Mitmproxy would be best. The text base UI may look a bit complicated but you don't have to use it, you can use mitmweb instead. Mitmproxy has man-in-the-middle support for HTTPS interception and the automatic certificate generation works very well and that is what is important to you.

You just need to make the tools (or the whole OS) you want to examine trust the Mitm root-CA certificate which is generated on first start. Mitmproxy provides a documentation how to install it's root CA certificate into various platforms.

Mitmproxy is Python based and also has a variant for a HTTP/HTML based UI mitmweb and a command-line version mitmdump.

On Windows I prefer Fiddler Classic as it's UI is clearly arranged. It also has built-in HTTPS interception support.

As last alternative you can use Wireshark, however that requires access to the pre-master secret of each HTTPS connection, which usually requires modification of the client application. On some applications changing a configuration file or injecting additional code is sufficient to get the pre-master secrets, but that depends on the client appliaction.