[{"data":1,"prerenderedAt":101},["ShallowReactive",2],{"case-https-origin-cert-mismatch-en":3,"blog-list-en":13},{"slug":4,"title":5,"summary":6,"date":7,"featured":8,"seoDescription":9,"series":10,"seriesOrder":11,"html":12},"https-origin-cert-mismatch","Origin Certificate Mismatch: Why DevPeek Still Captures the Site","When an origin certificate does not match its Host, DevPeek neither hides the failure nor stops the debugging session. The site and HTTPS plaintext remain available while request details clearly flag the certificate problem.","2026-09-14",false,"Why can DevPeek still open and decrypt a site after ERR_TLS_CERT_ALTNAME_INVALID? Learn how it checks origin Host and SAN, preserves HTTPS debugging, and reports the unverified peer identity.","api-debug-new-tricks",4,"\u003Cp>SSL proxying is on. The page loads, and its request headers, body, and response are all readable.\u003C/p>\n\u003Cp>Yet DevPeek marks the request and shows this warning in request details:\u003C/p>\n\u003Cblockquote>\n\u003Cp>Origin certificate does not match the hostname\u003C/p>\n\u003C/blockquote>\n\u003Cp>Open the origin certificate and you might find that the requested Host is:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-text\">admin.shop-example.com\n\u003C/code>\u003C/pre>\n\u003Cp>while its SAN (Subject Alternative Name) contains only:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-text\">*.cdn-host.cn\ncdn-host.cn\n\u003C/code>\u003C/pre>\n\u003Cp>This is not a false positive, and it does not mean that the DevPeek CA was installed incorrectly. The origin certificate cannot prove that the server represents the Host being requested.\u003C/p>\n\u003Cp>DevPeek does not silently ignore this condition or block you from examining it. Instead, it:\u003C/p>\n\u003Col>\n\u003Cli>Completes the TLS connection to the origin.\u003C/li>\n\u003Cli>Preserves HTTPS decryption and capture.\u003C/li>\n\u003Cli>Checks and records the origin certificate problem.\u003C/li>\n\u003Cli>Flags the risk in the capture list and request details.\u003C/li>\n\u003Cli>Lets you inspect the saved origin certificate.\u003C/li>\n\u003C/ol>\n\u003Cp>In debugging, certificate failures are evidence too.\u003C/p>\n\u003Ch2>Understanding \u003Ccode>ERR_TLS_CERT_ALTNAME_INVALID\u003C/code>\u003C/h2>\n\u003Cp>An HTTPS certificate lists the domain names it represents in SAN.\u003C/p>\n\u003Cp>For example:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-text\">Requested Host: admin.shop-example.com\nCertificate SAN: *.cdn-host.cn, cdn-host.cn\n\u003C/code>\u003C/pre>\n\u003Cp>Because \u003Ccode>admin.shop-example.com\u003C/code> is outside the certificate’s names, standard TLS hostname verification reports:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-text\">ERR_TLS_CERT_ALTNAME_INVALID\n\u003C/code>\u003C/pre>\n\u003Cp>It does not necessarily mean that the certificate file is corrupt. It means:\u003C/p>\n\u003Cblockquote>\n\u003Cp>I connected to A, but the server presented a certificate for B, so I cannot verify its identity.\u003C/p>\n\u003C/blockquote>\n\u003Cp>Common causes include:\u003C/p>\n\u003Cul>\n\u003Cli>The wrong certificate is bound at a CDN or WAF\u003C/li>\n\u003Cli>SNI is misconfigured at a reverse proxy\u003C/li>\n\u003Cli>DNS points to the wrong service\u003C/li>\n\u003Cli>A test environment reuses another environment’s certificate\u003C/li>\n\u003Cli>a Forward Rule or internal network sends traffic to a different server\u003C/li>\n\u003Cli>The origin certificate simply does not cover the requested domain\u003C/li>\n\u003C/ul>\n\u003Cp>A trailing dot such as \u003Ccode>admin.shop-example.com.\u003C/code> is also worth checking. It is a valid FQDN form, but a few proxies, gateways, and CDNs handle it inconsistently.\u003C/p>\n\u003Ch2>This is not an untrusted DevPeek CA\u003C/h2>\n\u003Cp>SSL proxying creates two TLS sessions:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-text\">Browser / App\n      │\n      │ TLS: DevPeek dynamic certificate\n      ▼\n   DevPeek\n      │\n      │ TLS: origin certificate\n      ▼\n    Origin\n\u003C/code>\u003C/pre>\n\u003Cp>The first session runs from the client to DevPeek. The client must trust the DevPeek CA so it can accept dynamically generated debugging certificates.\u003C/p>\n\u003Cp>The second runs from DevPeek to the origin. This is where DevPeek receives the real origin certificate discussed in this article.\u003C/p>\n\u003Cp>If the first certificate is not trusted, a browser commonly reports:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-text\">NET::ERR_CERT_AUTHORITY_INVALID\n\u003C/code>\u003C/pre>\n\u003Cp>If the second certificate does not match the requested Host, DevPeek reports:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-text\">Origin certificate does not match the hostname\n\u003C/code>\u003C/pre>\n\u003Cp>Reinstalling the DevPeek CA does not usually fix an origin mismatch. The two errors belong to different TLS sessions.\u003C/p>\n\u003Cp>If you have not captured your first HTTPS request yet, start with \u003Ca href=\"/en/docs/quick-start/\">Quick Start\u003C/a> and \u003Ca href=\"/en/docs/proxy-ssl/\">Proxy & SSL certificates\u003C/a>.\u003C/p>\n\u003Ch2>Why does DevPeek keep the request running?\u003C/h2>\n\u003Cp>Browsers, Node.js, and ordinary HTTP clients in strict mode normally treat a certificate verification failure as a hard error and terminate TLS.\u003C/p>\n\u003Cp>That is a sensible default for regular browsing because the client cannot authenticate the server.\u003C/p>\n\u003Cp>A debugging proxy has another concern. If DevPeek terminated the request immediately, you would also lose:\u003C/p>\n\u003Cul>\n\u003Cli>The actual page or API response\u003C/li>\n\u003Cli>Request and response plaintext\u003C/li>\n\u003Cli>The certificate returned by the origin\u003C/li>\n\u003Cli>CDN, SNI, DNS, and forwarding results\u003C/li>\n\u003Cli>Context needed to diagnose a test-environment certificate issue\u003C/li>\n\u003C/ul>\n\u003Cp>DevPeek therefore does not use origin verification failure as a hard stop. It completes the connection, independently checks the certificate, and associates any problem with the recorded request.\u003C/p>\n\u003Cp>More precisely, DevPeek does not “skip certificate checks.” It:\u003C/p>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>performs the checks without letting a failed check erase the debugging session, and clearly exposes the resulting risk.\u003C/strong>\u003C/p>\n\u003C/blockquote>\n\u003Cp>A page loading successfully means that TLS and HTTP completed. It does not mean that the origin certificate is valid.\u003C/p>\n\u003Ch2>What appears in request details?\u003C/h2>\n\u003Cp>Depending on the certificate, DevPeek can report:\u003C/p>\n\u003Cul>\n\u003Cli>Origin certificate does not match the hostname\u003C/li>\n\u003Cli>Origin certificate has expired\u003C/li>\n\u003Cli>Origin certificate is not trusted\u003C/li>\n\u003Cli>Origin certificate check failed\u003C/li>\n\u003C/ul>\n\u003Cp>Select \u003Cstrong>View origin certificate\u003C/strong> to inspect:\u003C/p>\n\u003Cul>\n\u003Cli>Subject\u003C/li>\n\u003Cli>Issuer\u003C/li>\n\u003Cli>SAN\u003C/li>\n\u003Cli>Validity\u003C/li>\n\u003Cli>Serial number\u003C/li>\n\u003Cli>SHA-1 and SHA-256 fingerprints\u003C/li>\n\u003Cli>PEM\u003C/li>\n\u003C/ul>\n\u003Cp>For a hostname mismatch, compare the request Host with SAN first.\u003C/p>\n\u003Cp>For example:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-text\">Requested Host: api.test.example.com\nCertificate SAN: *.example.com\n\u003C/code>\u003C/pre>\n\u003Cp>Those names do not match either. \u003Ccode>*.example.com\u003C/code> covers one subdomain level such as \u003Ccode>api.example.com\u003C/code>, not \u003Ccode>api.test.example.com\u003C/code>.\u003C/p>\n\u003Cp>The capture-list marker helps you find affected requests before opening \u003Ca href=\"/en/docs/capture/\">request details\u003C/a> for the full certificate.\u003C/p>\n\u003Ch2>What should you do with the warning?\u003C/h2>\n\u003Ch3>A test environment has the wrong certificate\u003C/h3>\n\u003Cp>DevPeek lets integration work continue, but the warning still identifies a configuration problem.\u003C/p>\n\u003Cp>Check:\u003C/p>\n\u003Cul>\n\u003Cli>Whether DNS resolves to the intended address\u003C/li>\n\u003Cli>Whether the CDN or WAF has the correct certificate\u003C/li>\n\u003Cli>Whether SNI is forwarded correctly\u003C/li>\n\u003Cli>Whether SAN covers the current Host\u003C/li>\n\u003Cli>Whether a reverse proxy returned its default-site certificate\u003C/li>\n\u003Cli>Whether a Forward Rule sent the request into another environment\u003C/li>\n\u003C/ul>\n\u003Cp>“Continue debugging” does not make the origin trustworthy.\u003C/p>\n\u003Ch3>You are investigating a certificate or gateway issue\u003C/h3>\n\u003Cp>This is exactly why preserving the request helps.\u003C/p>\n\u003Cp>Compare:\u003C/p>\n\u003Cul>\n\u003Cli>Request Host\u003C/li>\n\u003Cli>Actual remote address\u003C/li>\n\u003Cli>Origin Subject and SAN\u003C/li>\n\u003Cli>Issuer and validity period\u003C/li>\n\u003Cli>Applied Forward Rules\u003C/li>\n\u003Cli>Certificates returned for the same Host on different networks\u003C/li>\n\u003C/ul>\n\u003Cp>The certificate failure becomes part of the request evidence instead of making the evidence disappear.\u003C/p>\n\u003Ch3>Production or sensitive data is involved\u003C/h3>\n\u003Cp>Do not interpret “the page loads” as “the connection is safe.”\u003C/p>\n\u003Cp>A verification warning means DevPeek cannot authenticate the peer. It may be a test configuration mistake, or it may indicate an unexpected DNS, proxy-chain, or network endpoint.\u003C/p>\n\u003Cp>Until the cause is understood, avoid sending passwords, tokens, payment details, or other sensitive data.\u003C/p>\n\u003Ch2>Should you add the Host to Exclude?\u003C/h2>\n\u003Cp>You do \u003Cstrong>not\u003C/strong> need to exclude an origin-mismatch Host just to keep the site open. DevPeek keeps plaintext available and shows the warning so you can investigate it.\u003C/p>\n\u003Cp>With a CONNECT tunnel, certificate verification returns to the browser or app. If the origin certificate truly does not match, a strict client will probably block the connection itself.\u003C/p>\n\u003Cp>Exclude is a better fit when:\u003C/p>\n\u003Col>\n\u003Cli>HTTPS interception breaks the request, but tunneling restores it.\u003C/li>\n\u003Cli>The client pins certificates and rejects debugging certificates.\u003C/li>\n\u003Cli>You do not need plaintext for that traffic.\u003C/li>\n\u003Cli>You want the client to perform end-to-end certificate verification.\u003C/li>\n\u003C/ol>\n\u003Cp>For that separate case, see \u003Ca href=\"/en/blog/https-ssl-skip-decrypt/\">HTTPS Capture Breaks a Few Sites? Add Them to Skip SSL Proxy\u003C/a>.\u003C/p>\n\u003Ch2>Do not confuse TLS with application encryption\u003C/h2>\n\u003Cp>After HTTPS has been decrypted, JSON may still look like:\u003C/p>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "data": "7a3f..."\n}\n\u003C/code>\u003C/pre>\n\u003Cp>That is application-layer AES, RSA, Base64, or custom encoding—not a certificate problem.\u003C/p>\n\u003Cp>Use \u003Ca href=\"/en/docs/param-transform/\">Param Transform\u003C/a> for that layer. TLS protects the transport; Param Transform handles business payloads.\u003C/p>\n\u003Ch2>Three points to remember\u003C/h2>\n\u003Cp>First, a certificate that does not match Host means DevPeek cannot authenticate the origin. The warning is real.\u003C/p>\n\u003Cp>Second, DevPeek neither hides the problem nor stops debugging by default. The site and HTTPS plaintext remain available, and request details retain the certificate evidence.\u003C/p>\n\u003Cp>Third, Exclude controls which Hosts are not decrypted. It is not the mandatory fix for a certificate warning. The real fix belongs in the origin certificate, DNS, SNI, CDN, or forwarding configuration.\u003C/p>\n\u003Ch2>Next\u003C/h2>\n\u003Cp>This is currently the last article in the API debugging series. Continue with the \u003Ca href=\"/en/blog/\">blog index\u003C/a> or learn more about \u003Ca href=\"/en/docs/capture/\">capture and request details\u003C/a>.\u003C/p>\n\u003Chr>\n\u003Cp>If you are investigating a test certificate, CDN, or SNI issue, \u003Ca href=\"/\">try DevPeek\u003C/a> to preserve the request and origin certificate evidence. Share unusual cases on \u003Ca href=\"https://github.com/GYPengDev/devpeek/discussions\">GitHub Discussions\u003C/a>.\u003C/p>\n\u003Ch2>Related Docs\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"/en/docs/proxy-ssl/\">Proxy & SSL certificates\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"/en/docs/capture/\">Capture and request details\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"/en/docs/faq/\">FAQ\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"/en/docs/quick-start/\">Quick Start\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"/en/docs/map-route/\">Forward Rules\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Ch2>Series\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"/en/blog/api-param-encryption-debug/\">H5 API Encrypted? Decrypt It On the Fly with DevPeek\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"/en/blog/mock-map-route-split-api/\">New API Is Live, Frontend Hasn't Shipped? Debug with Forward Rules\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"/en/blog/https-ssl-skip-decrypt/\">HTTPS Capture Breaks a Few Sites? Add Them to Skip SSL Proxy\u003C/a>\u003C/li>\n\u003C/ul>\n",{"items":14},[15,22,28,29,36,42,48,55,62,68,74,82,88,95],{"slug":16,"title":17,"summary":18,"date":7,"featured":8,"seoDescription":19,"series":20,"seriesOrder":21},"dev-build-log-android-apk","测试机借来借去，我们不想再改系统代理","测试机在团队里转一次，Wi-Fi 代理就要跟着改一次。普通 App 写不了系统代理，于是我们做了 Android 配套 App，用 VpnService 把「换 IP、换端口」收成扫码切换。","DevPeek 开发实录：为什么做 Android 配套 App。测试机在团队里流转时不再反复修改 Wi-Fi 代理，而是通过 VpnService 扫码切换当前抓包电脑。","dev-build-log",5,{"slug":23,"title":24,"summary":25,"date":7,"featured":8,"seoDescription":26,"series":20,"seriesOrder":27},"dev-build-log-android-file-transfer-assistant","测试机连上以后，我们又做了个文件互传助手","团队测试机通常没有聊天软件，也不会登录个人账号，传一个 URL、截图或安装包都很麻烦。Android 配套 App 做完后，我们顺手在已有配对链路旁加了一条局域网互传通道。","DevPeek 开发实录：团队测试机没有聊天软件时，如何通过 Android 配套 App 的独立 WebSocket 与 HTTP 局域网通道，在手机和电脑之间互传文字、图片、视频和文件。",6,{"slug":4,"title":5,"summary":6,"date":7,"featured":8,"seoDescription":9,"series":10,"seriesOrder":11},{"slug":30,"title":31,"summary":32,"date":33,"featured":8,"seoDescription":34,"series":10,"seriesOrder":35},"https-ssl-skip-decrypt","HTTPS Capture Breaks a Few Sites? Add Them to Skip SSL Proxy","Your proxy and CA work, but a few sites or apps fail only when HTTPS decryption is enabled. Add those Hosts to Skip SSL Proxy so they use CONNECT tunnels while other HTTPS traffic remains readable.","2026-09-01","A few sites or apps fail when DevPeek SSL proxying is enabled? If they recover with decryption off or through a CONNECT tunnel, use Include and Exclude to skip only incompatible Hosts.",3,{"slug":37,"title":38,"summary":39,"date":40,"featured":8,"seoDescription":41,"series":20,"seriesOrder":11},"dev-build-log-silent-auto-update","After Leaving Electron, Silent Updates Had to Be Ours","After the move to Tauri, electron-updater was gone and the stock updater didn't match Launcher, Core, and Shell. Checks and downloads moved into the tray; apply is a silent overwrite after you confirm. It ships in 1.3.0.","2026-08-28","DevPeek dev log: building our own silent updater after Electron. The tray checks and downloads in the background; a click runs a silent install. Windows / macOS in 1.3.0.",{"slug":43,"title":44,"summary":45,"date":46,"featured":8,"seoDescription":47,"series":20,"seriesOrder":35},"dev-build-log-ws-mock-dsl","Why We Designed a WebSocket Mock DSL Instead of YAML, JSON, or JS","Lightweight WebSocket Mock shouldn't feel heavier than HTTP Mock. YAML, JSON, and JS all work—but they're wordy for connect, login, heartbeat. We built a short DSL to keep lightweight Mock light.","2026-08-13","DevPeek dev log: why WebSocket Mock uses a custom Flow DSL. YAML, JSON, and JS handle heavy cases; sequential lightweight scripts get a shorter text format.",{"slug":49,"title":50,"summary":51,"date":52,"featured":8,"seoDescription":53,"series":20,"seriesOrder":54},"dev-build-log-electron-to-tauri","DevPeek Architecture: Dropping Electron for Tauri","A debugging proxy shouldn't ship a whole Chromium just to open a window. We moved business logic into Core and swapped the desktop shell for Tauri—lighter installs, leaner background use, and the tray brings the UI back after you close the window.","2026-08-08","DevPeek dev log: moving the desktop shell from Electron to Tauri—business stays in Core, the shell handles windows and OS features, with smaller footprint and lower resource use.",2,{"slug":56,"title":57,"summary":58,"date":59,"featured":8,"seoDescription":60,"series":20,"seriesOrder":61},"dev-build-log-sqljs-to-better-sqlite3","Why We Moved Capture History from sql.js to Native SQLite","Early DevPeek stored captures in JavaScript-based SQLite (sql.js); busy sessions ate RAM and stuttered the list. Native SQLite keeps memory flat so the proxy can run all day.","2026-08-05","DevPeek dev log: moving capture storage from sql.js to native SQLite—fixing memory growth and list lag on all-day debugging sessions.",1,{"slug":63,"title":64,"summary":65,"date":66,"featured":8,"seoDescription":67,"series":10,"seriesOrder":54},"mock-map-route-split-api","New API Is Live, Frontend Hasn't Shipped? Debug with Forward Rules","After a service split, the frontend still hits the old API while orders already live on the new service. DevPeek Forward Rules forward specific endpoints to the new host without code changes; if the new service isn't ready, Mock gets the page working first.","2026-07-26","Microservice integration and API host migration: use DevPeek Forward Rules for API forwarding—point old-host requests to the new service without changing the frontend. Mock when migration isn't done. Includes a hands-on demo.",{"slug":69,"title":70,"summary":71,"date":72,"featured":8,"seoDescription":73,"series":10,"seriesOrder":61},"api-param-encryption-debug","H5 API Encrypted? Decrypt It On the Fly with DevPeek","Stuck with AES-encrypted API params during integration? Set the key and IV once in DevPeek Param Transform, and see plaintext automatically — you can even edit and re-encrypt on resend.","2026-07-18","Use DevPeek Param Transform to auto-decrypt AES-GCM encrypted H5 API requests. Supports two-way transform, plaintext editing, and debug replay.",{"slug":75,"title":76,"summary":77,"date":78,"featured":79,"seoDescription":80,"series":81,"seriesOrder":54},"h5-debug-console-mock","H5 Debug in Practice (2): Android WebView White Screen—From Console Remote Debug to Mock Validation","A campaign H5 white-screened on some Android devices after a button tap—all requests returned 200, but the page showed nothing. Using DevPeek Console to capture WebView runtime logs, remote eval to confirm a polyfill override, then Mock to verify the fallback UI under error conditions.","2026-07-13",true,"DevPeek H5 debug practice part 2: troubleshoot Android WebView white screen via Console remote debug to locate a JavaScript polyfill conflict, then use Mock to verify page fallback behavior under abnormal API responses.","h5-debug",{"slug":83,"title":84,"summary":85,"date":86,"featured":79,"seoDescription":87,"series":81,"seriesOrder":61},"wechat-h5-storage-debug","H5 Debug in Practice (1): WeChat H5 Local Cache—Debug It on Desktop","After switching test accounts in a WeChat official-account H5, the avatar still showed the old user—capture had the new token, stale data stayed in localStorage. This post walks through a real joint-debug case and how to view and edit localStorage, sessionStorage, and IndexedDB in WeChat WebView from your PC.","2026-07-11","DevPeek H5 debug: locate localStorage, sessionStorage, and IndexedDB cache issues in WeChat H5—compared with vConsole and remote debug, with real WebView debugging workflow.",{"slug":89,"title":90,"summary":91,"date":92,"featured":79,"seoDescription":93,"series":94,"seriesOrder":54},"why-we-built-devpeek-h5-debug","Why We Built DevPeek (2): That H5 Page in the App—Debug It on Your PC","Param transform fixed login, but the activity H5 only broke inside the App WebView. Remote debug and capture lived in different windows—so we folded mirroring and our own debug panels into DevPeek.","2026-07-10","DevPeek origin series, part 2: in-app H5 bugs that only show on real devices, the split between remote debug and capture, and how the Debug tab mirrors pages with built-in DOM, Console, and Network panels.","origin",{"slug":96,"title":97,"summary":98,"date":99,"featured":79,"seoDescription":100,"series":94,"seriesOrder":61},"why-we-built-devpeek","Why We Built DevPeek (1): HTTPS Decrypted, Body Still Gibberish","The night before a release, TLS was already open—but changing one request field still meant digging up encrypt/decrypt scripts. That pushed us toward a proxy tool with business-layer crypto built in—and DevPeek started there.","2026-07-09","DevPeek origin series, part 1: the manual request-body encrypt/decrypt grind—and why we set out to build a proxy tool that owns business-layer crypto.",1789537096026]