Trust JMeter's Recorder CA Only in Your Android Debug Build

Use a debug-overrides anchor for an app you own, then keep the manifest reference, actual recording CA and proxy route aligned.

If your owned debug app reaches JMeter but rejects HTTPS, supply its recording CA to the app's trust configuration:

  1. Start the actual JMeter HTTP(S) recorder and obtain its generated ApacheJMeterTemporaryRootCA.crt.
  2. Place that public CA in the app's raw resources as jmeter_debug_ca.crt.
  3. Merge this anchor with the existing network security rules:
<network-security-config>
    <debug-overrides>
        <trust-anchors>
            <certificates src="@raw/jmeter_debug_ca" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>

Reference that XML from the manifest's android:networkSecurityConfig. For network_security_config.xml, use @xml/network_security_config.

Android applies debug-overrides only when android:debuggable is true. It ignores the section when false. A debug-only anchor source of user is another option for a workflow intentionally trusting user-installed CAs.

Browser trust alone does not set the app's policy. The phone must still reach the recorder, and the app's network client must use that proxy. A custom stack may need its own supported trust input.

Erthyglow kevrennek