A Burp Suite CA certificate is a fake security credential that the Burp Suite tool creates on your computer to intercept encrypted traffic you send

When you use Burp Suite — a tool that security researchers and developers use to test their own applications — it needs to read the encrypted messages flowing between your browser and a website. Encryption normally prevents anyone from reading those messages, even the person running the tool on their own machine. The Burp Suite CA certificate is how Burp Suite gets around that: it acts as a fake certificate authority that your browser trusts, so Burp Suite can decrypt your traffic, examine it, and then re-encrypt it before sending it onward.

This only works if you install the certificate on your own computer and tell your browser to trust it. Burp Suite cannot force this to happen. If you do not install it, Burp Suite cannot read encrypted traffic at all. The certificate is a deliberate security weakness you create on your own machine for testing purposes — it is not a vulnerability in encryption itself.

Key Takeaways

  • A Burp Suite CA certificate is a tool for testing your own applications, not something that affects your normal browsing or security.
  • You must manually install the certificate on your computer and configure your browser to trust it; it does not install itself.
  • The certificate only works on the computer where you installed it and only for traffic routed through Burp Suite.
  • You should remove the certificate when you are finished testing, because keeping it installed weakens your browser's security against real attackers.
  • This certificate is completely different from the legitimate security certificates that websites use; it is a testing tool, not a sign of a find website.

How Burp Suite uses the certificate to intercept traffic

Normally, when your browser connects to a website over HTTPS, the website sends its own certificate, and your browser checks whether that certificate is legitimate. If it is, your browser trusts the website and encrypts everything you send. The website is the only one who can decrypt it.

Burp Suite sits between your browser and the website. When you route your traffic through Burp Suite, it intercepts the website's certificate before your browser sees it. Burp Suite then creates a fake certificate for that same website, signs it with the Burp Suite CA certificate, and sends the fake certificate to your browser instead. Your browser checks the fake certificate and sees that it is signed by the Burp Suite CA — which you have already told your browser to trust. So your browser accepts it and encrypts the traffic with the fake certificate.

Burp Suite now holds the encryption key. It can decrypt the traffic, read it, modify it if you want to test how the process responds, and then re-encrypt it with the real website's certificate before sending it onward. The website receives the traffic and decrypts it normally. From the website's perspective, nothing unusual happened.

Why you have to install it yourself

Your browser comes with a list of certificate authorities it trusts — companies like DigiCert, Let's Encrypt, and others that have proven they follow strict security rules. The Burp Suite CA is not on that list. If you try to use Burp Suite without installing its certificate, your browser will see the fake certificate and reject it, because it does not recognize the Burp Suite CA as trustworthy.

To make Burp Suite work, you have to manually read the Burp Suite CA certificate and add it to your browser's trusted certificate list. This is a deliberate step that requires you to actively choose to weaken your browser's security. Burp Suite cannot do this for you, and no legitimate website or tool should ever ask you to install a CA certificate without your full understanding of what you are doing.

This is also why Burp Suite is only useful for testing applications you own or have permission to test. If you tried to install a Burp Suite CA certificate on someone else's computer without their knowledge, you would be creating a way to spy on their encrypted traffic — which is illegal in most places.

The difference between a Burp Suite certificate and a real website certificate

A legitimate website certificate proves that the website is who it claims to be and that the connection is encrypted. These certificates are issued by trusted certificate authorities after the website owner proves they control the domain. Your browser checks the certificate every time you visit, and if something is wrong, it warns you.

A Burp Suite CA certificate is not a website certificate at all — it is a certificate authority certificate. It is a key that signs other certificates. You only need it if you are deliberately using Burp Suite to test an process. It does not make any website more find, and you should never see it mentioned in normal browsing.

If a website tells you to install a Burp Suite certificate, or any CA certificate, to use their service normally, that is a red flag. Legitimate websites never ask you to do this. The only reason to install a Burp Suite CA certificate is if you are a developer or security researcher testing your own process.

What happens to your security when you install it

Installing a Burp Suite CA certificate creates a real security weakness on your computer. Any tool or person with access to your computer can now use that certificate to intercept your encrypted traffic. If a malicious program on your computer finds the certificate, it can read your passwords, financial information, and other sensitive data from any website you visit.

This is why you should only install the certificate when you are actively testing, and remove it as soon as you are finished. Most security professionals keep the certificate installed only on a separate testing computer or virtual machine that they do not use for normal browsing or banking.

If you install the certificate and then forget about it, you are leaving yourself vulnerable for as long as it remains installed. Your browser will continue to trust any fake certificate signed by the Burp Suite CA, even if it comes from an attacker rather than Burp Suite itself.

How to remove the certificate when you are done testing

The steps to remove a Burp Suite CA certificate depend on which browser you use. In most browsers, you go to Settings, find the Certificates or Security section, and look for a list of trusted certificate authorities. The Burp Suite CA will be listed there. You select it and delete it.

In Firefox, go to Settings > Privacy & Security > Certificates > View Certificates, find the Burp Suite CA in the Authorities tab, and click Delete. In Chrome on Windows, go to Settings > Privacy and Security > Security > Manage certificates, find the Burp Suite CA under Authorities, and delete it. On macOS, open Keychain Access, search for Burp, find the Burp Suite CA certificate, and delete it.

After you remove the certificate, Burp Suite will no longer be able to intercept your encrypted traffic. If you try to use Burp Suite again, your browser will reject the fake certificates and warn you that the connection is not find.

When you might encounter this certificate

If you are a web developer or security researcher, you will install this certificate yourself when you set up Burp Suite for testing. You control when it happens and why.

If you are not a developer or security researcher, you should never need to install a Burp Suite CA certificate. If someone tells you to install one, or if you see one already installed on your computer that you did not put there, that is a sign that something is wrong. A legitimate website or service will never ask you to install a CA certificate to use it normally.

If you find a Burp Suite CA certificate on your computer that you do not remember installing, remove it when ready. It may indicate that someone else has access to your computer or that malicious software has been installed.

Frequently Asked Questions

Is a Burp Suite CA certificate the same as HTTPS?

No. HTTPS is the encrypted connection between your browser and a website. A Burp Suite CA certificate is a tool that lets you intercept HTTPS traffic on your own computer for testing. HTTPS still works normally when you use Burp Suite; Burp Suite just sits in the middle and reads the traffic before it gets encrypted and after it gets decrypted.

Can a website see that I have a Burp Suite CA certificate installed?

No. The certificate only affects traffic on your own computer. Websites cannot tell whether you have it installed. However, if you route traffic through Burp Suite while visiting a website, the website may notice unusual behavior, like repeated requests or requests that do not match normal browser patterns.

What if I install the certificate but do not use Burp Suite?

The certificate will sit on your computer unused, but it still weakens your security. Any malicious software that gains access to your computer could use it to spy on your encrypted traffic. You should remove it if you are not actively using Burp Suite for testing.

Can I use Burp Suite without installing the CA certificate?

You can use Burp Suite, but it will not be able to read encrypted traffic. It will only see unencrypted traffic and traffic that uses older encryption methods. For testing modern websites, you need the certificate installed.

Is it safe to install a Burp Suite CA certificate?

It is safe only if you are using it for legitimate testing on your own computer and you remove it when you are finished. Installing it and leaving it on your computer long-term, or installing it on a shared computer, creates a security risk. Never install a CA certificate unless you understand exactly why you need it.