This is explained in their page on SSL proxying, perhaps not with enough explanations.
A proxy is, by definition, a man-in-the-middle: the client connects to the proxy, and the proxy connects to the server.
SSL does two things:
- It ensures the confidentiality and integrity of the established connection.
- It performs some verification of who you are connecting to.
It's the second part that's important, and seemingly broken, here: you're sitting at your browser, and surprised that your browser is connecting to the proxy whereas you expected it to connect to Facebook. Technically, the proxy is not sniffing the HTTPS traffic, it's relaying it.
Your browser knows that it's connected to Facebook because the site has a certificate that says “I am really
www.facebook.com”. Public-key cryptography, by means that I will not get into here, ensures that only the holder of the private key can initiate a valid connection with this certificate. That's only half the battle: you only have the server's claim that it really is
www.facebook.com and not
randomhijacker.com. What your browser does is additionally check that the certificate has been validated by a certificate authority. Your browser or operating system comes with a list of certificate authorities that it trusts. Again, public-key cryptography ensures that only the CA can emit certificates that your browser will accept.
When you connect to the proxy, your browser receives a certificate that says “I am really
www.facebook.com”. But this certificate is not signed by a CA that your browser trusts by default. So:
- either you received a warning about an insecure HTTPS connection, which you clicked through to see the concent at
- or you added the CA that signed the proxy's certificate (“Charles's CA certificate”) to your the list of CAs that your browser trusts.
Either way, you told your browser to trust the proxy. So it does. An SSL connection is not secure if you start trusting random strangers.
Recommended reading for further information: