MITM proxy ignore SSL certificate verification for android apps

user_2224175 0
Viewed 2115

Problem Description

Trying to capture the traffic from an Android device using reverse tethering and then proxying the traffic to mitmproxy, we've installed the MITM certificate in the device. Browser traffic is working fine but application traffic is giving SSL certificate errors. tried to use --ssl-insecure flag as well but didn't work.

Steps to reproduce the behaviour:

  1. Run MITM proxy
  2. Forward the traffic to proxy using reverse tethering and proxychains.
  3. Installed MITM certificate in the device
  4. Browser traffic is working fine (both HTTP & HTTPS) but application traffic is not working, giving certificate errors.
  5. Used a path tls_passthrough as well. Half of the apps traffic works but still apps like amazon doesn't work due to SSL pinning

How to bypass SSL certificate verification?

System Information

Checked with version 6 & 7 both on (Ubuntu & Android).

mitmproxy proxy ssl
2 Answers

--ssl-insecure controls whether mitmproxy validates the certificate it received from the upstream server. This does not affect how the client is checking the certificate generated by mitmproxy.

If the client does not trust mitmproxy, you need to fix that on the client. Robert has provided some pointers in the comments for Android specifically.

user_9347190

I found changing the options to disable HTTP2 worked for me:

Enable/disable HTTP/2 support. HTTP/2 support is enabled by default.

user_200430070
Related