== Proxy from ZAP to HTTPS

The ZAP proxy can also be configured to proxy *HTTPS* requests. It will terminate the HTTPS connection in ZAP and then proxy it to the target using its keystore. You can even proxy to sites with mutual TLS. In that case, you configure OWASP ZAP with the keystore and key to use for the connection.

Go to Tools/Options/Client Certificate to proxy to a mutual TLS HTTPS site.
Go to Tools/Options/Connection if you want to set timeouts and want to force the use of TLSv1.2 e.g.


=== Export the certificate

Depending on the local tools installation, ZAP can start a browser directly with some adjusted options like network settings and certificate adjustments. However, you should do this step if you want to start your browser independently of ZAP. To be able to use the browser, the browser needs the certificate, which you can export here:

image::images/rootca.png[ZAP root CA,style="lesson-image"]
image::images/savecerts.png[ZAP save CA,style="lesson-image"]



=== Import the OWASP ZAP root certificate

. Go to your Firefox Preferences (Mac, Linux) or Options (Windows) from the menu.`
. Search for _certificates_
. Click _View certificates_
. Import the ZAP root certificate that was saved (see the previous page)

image::images/firefoxsettingscerts.png[Firefox Certificates,width="75%",style="lesson-image"]

image::images/importcerts.png[Firefox Certificate import,width="75%",style="lesson-image"]
