Sslsplit works with all https traffic(for all victim websites). but I want swap cert only for one domain. How to do it?
Generate the forged certificate matching the hostname you want to intercept manually using OpenSSL, and use the -t and -P options of sslsplit. The -t mode reads target certificates from a directory and uses them whenever a connection matches the common name of a certificate in the directory, instead of generating forged certificates on the fly. Make sure not to give sslsplit a CA certificate and key (no -c/-k options). Use -P to make sslsplit pass connections that don't match any certificate in the directory given by -t.
There is also an IP based way to achieve this, if your target site uses a dedicated IP address. You simply only redirect the IP of your target website to sslsplit in your NAT setup.