I recently updated an Android app from targeted API 23 to 28. The biggest issue I am having after deploying to my users is that maybe 1 in 1000 users cannot log in anymore! After getting the logs from them, I found something I hadn't ever seen before. The certificate they're getting is not the certificate I'm serving, and it's being rejected by Android.
I know that some offices and such will MITM SSL certificates, and I suppose some of my users could be completely hacked... I had the users try to use our website, which uses the same SSL certificates as the app, and it works fine for them--so, if this is some MITM (on purpose or not), it's "configured correctly" on their web browser, but not for our app.
When looking at the false certificate details, I see multiple users have the same false Issuer:
06-25 16:49:00.800 25286 25377 E CONSCRYPT: ------------------Untrusted chain: ----------------------
06-25 16:49:00.800 25286 25377 E CONSCRYPT: == Chain0 ==
06-25 16:49:00.800 25286 25377 E CONSCRYPT: Version: 3
06-25 16:49:00.800 25286 25377 E CONSCRYPT: Serial Number: d0ca...0df
06-25 16:49:00.800 25286 25377 E CONSCRYPT: SubjectDN: CN=*.REDACTED.COM, CN=*.REDACTED.COM
06-25 16:49:00.800 25286 25377 E CONSCRYPT: IssuerDN: CN=afwlocalproxy
06-25 16:49:00.802 25286 25377 E CONSCRYPT: Get not before: Sun Jun 23 13:43:18 GMT+12:00 2019
06-25 16:49:00.802 25286 25377 E CONSCRYPT: Get not after: Mon Jun 22 13:43:18 GMT+12:00 2020
06-25 16:49:00.802 25286 25377 E CONSCRYPT: Sig ALG name: SHA256withRSA
06-25 16:49:00.802 25286 25377 E CONSCRYPT: Signature: 59c279...07f810
06-25 16:49:00.814 25286 25377 E CONSCRYPT: Public key:
06-25 16:49:00.814 25286 25377 E CONSCRYPT:
06-25 16:49:00.814 25286 25377 E CONSCRYPT: 30 82 ... 00 03
06-25 16:49:00.814 25286 25377 E CONSCRYPT: 82 01 ... 88 d7
....
(I replaced the domain with REDACTED and some numbers with ...)
Does anyone know what afwlocalproxy is? Is it an Android for Work thing? Is it AFW Proxy (https://afw-proxy-server.soft112.com/)? I scoured the internet a bit and didn't see anything, except two or three packet log analyses that look almost identical to mine above. I guess another possibility is that afwlocalproxy is just the name of some configured SSL proxy server, and these affected users all work at the same company or something.
These users were using the app just fine before the upgrade, and then upgraded, and it instantly stopped working for them. It is now 100% reproducible for them. One of them is on a Pixel 2, but they all have mentioned "security software" being installed on their phones by their providers or workplace.