HTTPS

GoReplay raw capture does not decrypt TLS. To capture requests arriving over HTTPS, use an accessible plaintext HTTP leg after your TLS terminator. Your application code can remain unchanged when that capture point already exists.

client --HTTPS--> TLS terminator --HTTP--> app :8080
                                          |
                                  GoReplay capture

Find the actual capture point

• If nginx, Envoy or a load balancer forwards HTTP upstream, capture that HTTP port from a host or namespace that can see it.
• If the upstream is also HTTPS, it remains encrypted. Capturing that port does not expose HTTP.
• If the application terminates TLS inside its process and exposes no plaintext leg, choose another permitted capture method or topology. Packet capture alone is insufficient.

See interfaces and capture permissions. For a comparison of plaintext capture, TLS-aware proxies and supported process-level collection, read capturing HTTPS on a server.

Replay to an HTTPS target

Use an https:// URL with --output-http. HTTPS output establishes a new target connection; it does not decrypt the original capture or reuse the production TLS session. Keep certificate verification enabled. The --output-http-skip-verify option disables verification and is not a normal capture requirement.

Prepare test credentials, target state and isolated downstream services before replay. Follow saved-file replay and middleware for the remaining setup.

Continue with shadow testing or record and replay verification.