Enable HTTPS Decryption with Surge on Apple TV

Enabling MITM on Mac or iPhone with Surge is straightforward. How do you do it on Apple TV? Here’s the process I use.

Option 1: Mac Gateway Mode

If Surge on macOS runs in gateway mode with MITM enabled, every Apple TV request routed through the Mac is decrypted automatically—even if Surge on tvOS is off.

Option 2: Direct MITM on Apple TV

1. Export the certificate from Surge on macOS/iOS (whichever device generated the tvOS profile). Use the same device that created the config to avoid mismatched certificate settings.

   

2. Upload the certificate to a cloud service (e.g., Dropbox) to obtain a direct download link. I use Dropbox with dl=1, such as https://www.dropbox.com/scl/fi/aaa.crt?rlkey=xxx&e=1&dl=1.

3. On Apple TV: Settings → General → Privacy & Security. Under “Share Apple TV Analytics,” press the Play button to add a profile. Enter the certificate URL, then complete the installation.

   

4. Go to Settings → General → About → Certificate Trust and trust the certificate.

5. Add MITM rules to the Surge tvOS profile just as you would on macOS or iOS.

6. MITM is now active—you can inspect traffic via Surge Dashboard on Mac or iPhone.

Some services (Spotify, Apple, etc.) use SSL pinning. Don’t MITM those hosts or the apps will fail.

Final Thoughts

That’s all it takes to enable MITM on Apple TV.

References

• https://manual.nssurge.com/http-processing/mitm.html
• https://github.com/DualSubs/Universal/wiki/%E5%9C%A8Apple-TV-%28tvOS%29-%E4%B8%8A%E6%B7%BB%E5%8A%A0%E6%8F%8F%E8%BF%B0%E6%96%87%E4%BB%B6%E6%88%96MitM%E8%AF%81%E4%B9%A6