I'm following this guide for an university project: https://checkmarx.github.io/Kotlin-SCP/m3-insecure-communication/
The attack works properly, but when I change to https i get that error. Googling I've seen that maybe the problem is Android, because the Let's Encrypt SSL certificate works on local so my phone doesn't recognize it as a valid certificate (?)
Perhaps I'm not setting the certificate from Let's Encrypt right. Can someone help?
i'm facing problem when implementing ssl to my web. My web work as web services for android and ios. All goes very smooth until i implement the SSL certificates, suddenly the android (most of android except samsung) throw this error :
E/ErrorHTTP: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
then i google and landed to here :
google says about the error
support the google statement
work around for the error to accept the not valid ssl
it says that mostly happened because of :
The CA that issued the server certificate was unknown
The server certificate wasn't signed by a CA, but was self signed
The server configuration is missing an intermediate CA
Those three options already ruled out, i already check with ssl checker. Its none of those above, it's not unknown, it's not self signed, we're using comodo and the intermediates and root certificates also valid, you can check here : ssl checker for my link,
you can check it by yourself.
And now i'm stuck, the certificate is valid. The certificate also can open in samsung, but somehow fail in some other brand, for example xiao mi. I don't know where to look now, is it the :
the ssl configuration, i need to keep digging, even though it marked as valid in most validator.
make the android code more vulnerable, even some brand can access it, i mean is it because the brand or how ?.
The spec im using :
ASP .Net Core 2.0.
Kestrel.
Comodo certificates.
Native android.
Please help !, thank you.
We have an internal CA server.
We have an Android app that should communicate via https with our webserver, and have generated the required certificates. When we connect to the server through our app, it fails with the current stacktrace:
Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
But when we browse the server through Android Chrome it works, and we get a green keylock. We have uploaded the certificate on the android device under settings. So it's listed under User certificates.
My question is: Do I need to do anything codewise? I figured that the app would look at the certificates located on the phone, and use this. The way Chrome seems to do. But some guides tell me that I manually have make a keystore and supply this to the SSLFactory (Link to guide). But on other pages it seems that this should work out of the box...
Can anyone point me in the right direction?
I can't browse to my web application from visual studio while using a android emulator. I get an empty response error on the browser. When I browse to my local application from my computer, it works. I used the ip 10.0.2.2 on android emulator instead of localhost. Anybody can help me?
Check your console for any errors. I was having this issue and was seeing Failed to validate the certificate chain, error: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. because my locally issued certificate was invalid.
For development I overrode WebviewClient according to this answer and was able to get it working. Make sure to remove before releasing to production to prevent your application from being susceptible to man-in-the-middle attacks.
I have Android 4.3 forced to use Charles proxy via IPTABLES.
The charles certificate is installed on the phone.
I am able to capture normal SSL traffic like https websites in the browser.
All POST and GET methods seem to work fine.
In a particular app, it fails when using the SSL CONNECT method.
URL: https://XX.XX.XXX.XXX/
Status: Failed
Failure: SSLHandshake: Received fatal alert: unknown_ca
Response Code: - Protocol: HTTP/1.0
Method: CONNECT
From iOS 10.3 you also need to go to Settings > General > About > Certificate Trust Settings and trust Charles certificate.
You can face with this problem at some applications like Facebook or Instagram.
Charles certificate doesn't work at some new apps because they are using a technique named as SSL-PINNING. First of all you have to break ssl-pinning system of application or you can instal old version of application then it sometimes works but we need a new solution about ssl pinning in order to record traffic for this kind of applications.
as #Berkay Yıldız says, it probably using ssl/certificate pinning.
how to fix/avoid/disable ssl pinning?
the whole logic is:
LEVEL 1: for normal http：
core logic：
PC：Mac/Windows
Charles set http proxy
set port
app use Charles proxy
inside Wifi, set
host IP
port
Note：
computer side, MUST use wired network, NOT wireless, otherwise mobile side network not usable
LEVEL 2: for encrypted https：
PC
install Charles root certificate
Mac：use Key Chain to trust Charles Root CA
Charles
Enable SSL Proxying
set location filter for your specific api address
phone
app
install Charles Root CA
Note: type should select: VPN and Application
NOT select：WLAN
makesure certificate install successfully
Trusted Credentials -> User, can see installed Charles certificate
LEVEL 3: for SPECIAL https which using ssl pinning:
Phone：
make sure root or jailbreak
Android：has rooted
for later to install tool: Xposed
iOS：has jail break
for later to install tool: Cydia
then install plugin/tool, capable of avoid/disable ssl pinning
Android：
JustTrustMe (based on Xposed)
Android-SSL-TrustKiller (Cydia Substrate)
iOS：
SSL Kill Switch 2 (based on Cydia)
old version：iOS SSL Kill Switch (based on Cydia)
more detailed summary please refer my post (written in Chinese): 1 and 2
Some folks my end up here with android N Devices that won't do SSL over charles even after installing the cert - now on http://chls.pro/ssl
In N - you need to also add an xml file and security config. This post goes into more details: How to get charles proxy work with Android 7 nougat?
I have met the same problem. And after installing the latest certificate, it is solved.
On your phone, visit http://charlesproxy.com/getssl to download the cert. Upon downloading the cert in android, it will prompt you to install the cert, give the cert a name and continue. It should now work.
Note: The sshould be similar on an iPhone
I got the following error when I was trying to install the cert on my Nexus 6p, Android 6.0. (I followed the instructions in charles and downloaded the cert via http://chls.pro/ssl.):
Couldn't install because the certificate file couldn't be read.
The solution to this problem was to install via:
Settings > Security > Install from storage
After navigating to the cert file and installing it everything worked as expected.
On this link http://www.charlesproxy.com/documentation/using-charles/ssl-certificates/ you have all the information you need on properly installing the Charles certificate.
After installing it you'll get rid of the "SSLHandshake: Received fatal alert: unknown_ca" error.
If you get this with an app using facebook login on an android phone, I got around it by uninstalling the fb app. Then the mobile fb web is used instead and I can charles everything. With the fb app installed the fb api fails with SSL error.
On Samsung phones, you should install the certificate by navigating to Biometrics and security/Other security settings/Install from device storage/CA Certificate.
I am using Charles 4.2.5 and Nexus 6P on Android 8.1.
One cannot use Charles to track https on my mobile phone.
Plz note that after Android N, we cannot capture normal SSL traffic of others'app.
Here is the official website of Charles.
https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/
Android As of Android N, you need to add configuration to your app in
order to have it trust the SSL certificates generated by Charles SSL
Proxying. This means that you can only use SSL Proxying with apps that
you control.
In order to configure your app to trust Charles, you need to add a
Network Security Configuration File to your app. This file can
override the system default, enabling your app to trust user installed
CA certificates (e.g. the Charles Root Certificate). You can specify
that this only applies in debug builds of your application, so that
production builds use the default trust profile.
Add a file res/xml/network_security_config.xml to your app:
Then add a reference to this file in your app's manifest, as follows:
...