To observe encrypted OAuth traffic, you import an intercepting proxy's (e.g. ZAP's) Root CA certificate into the browser. What does this accomplish, and what attack does it mimic?
It makes the browser trust certificates the proxy generates on the fly, so ZAP can decrypt and re-encrypt HTTPS traffic — i.e. you deliberately run a Man-in-the-Middle (MitM) attack on yourself.
* ZAP TLS intercept: a trusted Root CA lets the proxy MITM HTTPS. *
HTTPS normally stops anyone in the middle from reading traffic. An intercepting proxy like OWASP ZAP defeats this for analysis by:
- Terminating the browser's TLS connection itself, presenting a certificate it forged for, say,
auth0.com. - Opening its own TLS connection onward to the real server.
The browser would normally scream "untrusted certificate" — unless the proxy's Root CA is in its trust store. By importing ZAP's Root CA, you tell the browser "trust anything this CA signs," so the forged certs are accepted silently.
That's textbook MitM: ZAP sits between you and the server, seeing everything in cleartext.
Tip: Firefox keeps its own certificate store, but Edge and Chrome use the Windows certificate store — that's why the WebAuthn part imports the CA via certmgr.msc instead of the browser settings.
Go deeper:
OWASP ZAP: Root CA certificate — ZAP's docs on the Root CA it uses to decrypt TLS by forging per-site certs.
Man-in-the-middle attack (Wikipedia) — the attack (incl. HTTPS spoofing with a fake certificate) the proxy reproduces.