Why doesn't Android decrypt this app?

If a row shows a connection instead of a decrypted body, this is almost always Android’s own rule about which certificates an app trusts, not a HTTPGlass bug.

The short version

Apps targeting Android 7 (API level 24) or later do not trust user-installed certificate authorities by default (Android Developers Blog, July 2016). An app must opt in through its network security configuration or its own TLS implementation. Installing HTTPGlass’s root certificate therefore does not make every installed app decryptable.

What may work: browsers that honour the device’s user certificate store, and your own debug build configured to trust the HTTPGlass root. Behaviour depends on the browser, app and TLS stack.

What usually does not: third-party release apps that do not opt in, clients using a separate trust store, and traffic protected by certificate pinning.

For a connection that cannot be decrypted, HTTPGlass can show available connection metadata; the encrypted HTTP headers, method and body are not readable. On Mac, clients that use custom trust stores or certificate pinning can also refuse a root trusted by macOS.

See Android’s network security configuration documentation for the platform defaults and debug-only trust overrides.

Trusting it in your own debug build

Add a network security config that trusts user-installed certificates in debug builds only, so production users of your app are unaffected:

res/xml/network_security_config.xml

<network-security-config>
    <debug-overrides>
        <trust-anchors>
            <certificates src="user" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>

Reference it from your debug manifest:

<application android:networkSecurityConfig="@xml/network_security_config">

<debug-overrides> only applies when android:debuggable="true", which Android sets automatically for debug build variants, so a release build ships without this exposure.

What this isn’t

HTTPGlass does not provide a general certificate-pinning bypass. Android’s standard network security configuration skips its own pins for certificate chains anchored in a debug-only trust anchor, but custom pinning and custom TLS stacks can still reject the connection. When debugging your own app, use a debug build configured for inspection and keep production trust settings unchanged.

Still unsure which case you’re in?

Open the row in HTTPGlass. It labels encrypted-but-undecrypted connections plainly, so you can tell at a glance whether an app is skipping the user CA (the common case) or actively pinning (rarer, and shows the same way to any debugging tool).