By default BusymateHelper only decrypts HTTPS for the domains you put on the SSL-proxy list. Everything else still flows through, but stays encrypted — so you see only the hosts you actually want to inspect, and nothing else gets touched.
The SSL-proxy list
Find it under the gear on the readiness card: Settings → Tunnel → SSL Proxying. The list is the allow-list of hosts whose full request and response bodies become readable.
- Tap Add Domain and enter a host.
- Swipe an entry to delete it.
Match patterns:
| Pattern | Matches |
|---|---|
example.com | exactly that host |
*.example.com | the parent domain and any subdomain, at any depth |
Note: Hosts that aren't on this list still appear in the Network tab as encrypted connections — you'll see the domain and request count, but not the contents. The padlock icon tells you which is which: an open lock means it's decrypted, a closed lock means it's HTTPS you can only see the host of.
Tip: After changing the SSL-proxy list, restart the VPN so the tunnel extension picks up the new list. PAC-mode capture isn't affected by tunnel restarts.
Two related toggles
In Settings → Tunnel:
- Inspect All Requests — off by default: the Network tab logs only SSL-proxy domains. On: it logs every connection it sees.
- MITM All Hosts — off by default: only SSL-proxy domains get full HTTPS interception. On: every HTTPS host is decrypted. This is heavier and requires the CA to be trusted everywhere, so leave it off unless you specifically need it.
Hide noise with Ignore Hosts
Some hosts are pure background chatter — telemetry, push keep-alives, OS services. Add them under Settings → Tunnel → Ignore Hosts and they're filtered out of capture entirely, keeping your feed focused on what matters.
Push changes from the dashboard
You don't have to manage the list on the device. From the dashboard you can edit a device's SSL-proxy domains (and other per-device settings) and they push to the device live over Realtime — no restart needed for PAC, and the app applies them as they arrive.
SSL-proxy domains can also be pre-filled from service groups you apply in the dashboard, so a common set of hosts can be applied to many devices at once.
Tip: For how the decrypt decision is made per connection and how the list reaches the tunnel, see BusymateHelper architecture.
Scripts run on decrypted hosts only. A script (or a path-precise block rule) can only read and mutate a host's traffic if that host is on this SSL-proxy list — a passed-through encrypted host is matched by name only. Add a host here before scripting it.