We are having API access issue for Android Signed build.
We are building app through Ionic Framework.
Below are some observations -
-iOS and Android Un-Signed builds are working properly.
-In Browser API's are accessible.
-But for Android Signed build, API's are not accessible in Mobile Network.
Add this: android:usesCleartextTraffic="true" under application tag of your manifest and this should work.
It should look like this:
<application
...
android:usesCleartextTraffic="true"
...>
usesCleartextTraffic which is responsible for http calls is true by default but starting with Android 9 (Pie) Clear Text Traffic is disabled now.
After long research finally i resolved this.
Reason behind https requests fails only while releasing Android build APK is an issue with the SSL certificate when making https requests.if the intermediate certificates are not set up correctly then it would cause the request to fail on Android in release mode.
Below is the issue i found after checking https url in SSL URL checker.
The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate
Related
I have followed instructions on how to add fiddler certificate on android emulator, using both nox and memu emulators, as well as my android phone running marshmallow, I set the WiFi proxy to point to my PC over the local network, when I open a website using a web browser, things work fine, I receive the warning, I choose to proceed and the connection is successfully tunneled and decrypted using fiddler.
But, when I try to use other apps, connections fail! I see the tunnel connections, and then connection fails. My bet is, it's due to the invalid HTTPS certificate, so my question is, is there a way for me to install fiddler to the trusted authorities so connecting to it will go through without the warning? So I can finally debug HTTPS traffic from and to those apps.
I found similar questions here on SO, but none of them were exactly the same as mine, nor did they have the right answers, so I'm not sure if this question does in fact qualify as a duplicate.
Thanks
On modern Android devices using apps developed for target API Level 24 (Android 7) or higher sniffing traffic is not that simple anymore. The target API level of an app is defined it's AndroidManifest.xml file in the entry <uses-sdk android:targetSdkVersion="??"/>.
The main problem is that if you install the Fiddler root CA certificate in Android it is marked as user certificate (not system certificate). And unless explicitly configured in an app those user certificates are not trusted.
One of those rare apps that respect user CA certificates is Chrome. So using Chrome for testing if the proxy and the installed root CA certificate works is a bad idea, as it may only work in Chrome but not for apps.
Note that some apps further use certificate pinning (leaf or root CA pinning). Therefore even if the Fiddler root CA certificate is installed as system certificate the app won't trust this certificate as it fails on the certificate pinning.
Certificate pinning is also a web site feature, hence some sites save a certificate hash in the web browser cache that pins the site to a certain certificate. In such a case clearing the browser cache is usually removing those pinning data.
Rooted devices
If your device is rooted you can try to install the Fiddler root CA certificate as system certificate. The Mitmproxy documentation contains a how-to for manually installing the mitmproxy certificate.
If you have rooted the phone using Magisk, there is a Magisk module that seems to be able to install user certificates automatically as system certificates: https://github.com/NVISO-BE/MagiskTrustUserCerts
Alternatively you can install Magisk + Edxposed + TrustMeAlready Xposed module. This allows to disable certificate checking system wide - WARNING: this eliminates the security of SSL/TLS against active attacks, for all apps on the phone. Therefore only do this on a device you use just for hacking!
Also possible is installing and run Frida-Server on the device and hook into the app you are interested to modify the SSL/TLS certificate checking at run-time. AFAIK the Frida based framework Objection has some scripts to do so.
Non-rooted device
On a non-rooted device there is only the option to modify the application before you install it onto the device. Note that some apps will detect that they have been modified and will refuse to work.
To let the app trust user certificates you have to modify network_security_config.xml (see e.g. here) included in the app. You can use apktool to decompile/recompile the app. Don't forget to re-sign the recompiled/repackaged app e.g. using apksigner from Android SDK.
There are some tools available that automate the decompiling , modification and signing like apk-mitm.
There is also the possibility to modify an app by including the Frida gadget for Android into the app. This would allow to use Frida for this specific app on a non-rooted device.
Is there a way to ignore the self signed ssl as react native is using okHTTP3 on android under the hood and its not allowed to fetch from self signed SSL APIs, in my case its going to be always a local RestAPI and it will run on the local network. what is the workaround?
You can specify in your dev build that a particular host is insecure
See https://stackoverflow.com/a/61884408/1542667
https://square.github.io/okhttp/4.x/okhttp-tls/okhttp3.tls/-handshake-certificates/-builder/add-insecure-host/
In the end i used HTTP with clear type in the android manifest file.
android:usesCleartextTraffic="true"
I have followed instructions on how to add fiddler certificate on android emulator, using both nox and memu emulators, as well as my android phone running marshmallow, I set the WiFi proxy to point to my PC over the local network, when I open a website using a web browser, things work fine, I receive the warning, I choose to proceed and the connection is successfully tunneled and decrypted using fiddler.
But, when I try to use other apps, connections fail! I see the tunnel connections, and then connection fails. My bet is, it's due to the invalid HTTPS certificate, so my question is, is there a way for me to install fiddler to the trusted authorities so connecting to it will go through without the warning? So I can finally debug HTTPS traffic from and to those apps.
I found similar questions here on SO, but none of them were exactly the same as mine, nor did they have the right answers, so I'm not sure if this question does in fact qualify as a duplicate.
Thanks
On modern Android devices using apps developed for target API Level 24 (Android 7) or higher sniffing traffic is not that simple anymore. The target API level of an app is defined it's AndroidManifest.xml file in the entry <uses-sdk android:targetSdkVersion="??"/>.
The main problem is that if you install the Fiddler root CA certificate in Android it is marked as user certificate (not system certificate). And unless explicitly configured in an app those user certificates are not trusted.
One of those rare apps that respect user CA certificates is Chrome. So using Chrome for testing if the proxy and the installed root CA certificate works is a bad idea, as it may only work in Chrome but not for apps.
Note that some apps further use certificate pinning (leaf or root CA pinning). Therefore even if the Fiddler root CA certificate is installed as system certificate the app won't trust this certificate as it fails on the certificate pinning.
Certificate pinning is also a web site feature, hence some sites save a certificate hash in the web browser cache that pins the site to a certain certificate. In such a case clearing the browser cache is usually removing those pinning data.
Rooted devices
If your device is rooted you can try to install the Fiddler root CA certificate as system certificate. The Mitmproxy documentation contains a how-to for manually installing the mitmproxy certificate.
If you have rooted the phone using Magisk, there is a Magisk module that seems to be able to install user certificates automatically as system certificates: https://github.com/NVISO-BE/MagiskTrustUserCerts
Alternatively you can install Magisk + Edxposed + TrustMeAlready Xposed module. This allows to disable certificate checking system wide - WARNING: this eliminates the security of SSL/TLS against active attacks, for all apps on the phone. Therefore only do this on a device you use just for hacking!
Also possible is installing and run Frida-Server on the device and hook into the app you are interested to modify the SSL/TLS certificate checking at run-time. AFAIK the Frida based framework Objection has some scripts to do so.
Non-rooted device
On a non-rooted device there is only the option to modify the application before you install it onto the device. Note that some apps will detect that they have been modified and will refuse to work.
To let the app trust user certificates you have to modify network_security_config.xml (see e.g. here) included in the app. You can use apktool to decompile/recompile the app. Don't forget to re-sign the recompiled/repackaged app e.g. using apksigner from Android SDK.
There are some tools available that automate the decompiling , modification and signing like apk-mitm.
There is also the possibility to modify an app by including the Frida gadget for Android into the app. This would allow to use Frida for this specific app on a non-rooted device.
I'm using a package called coroinium cloud and I have recently set up ssl. Coronium cloud is a server package for apps developed with corona SDK. It uses nginx as the server for the package. There is a control panel that you connect to through your browser which loads fine and firefox says the certificate is trusted. However it does not work on the app but instead shows an error saying the certificate is not trusted (CertPathValidatorException on android). I used a tool by digicert to check the ssl configuration:
screenshot of digicert test
There were instructions by the creator of coronium cloud on how to set it up of which all I followed. I got the certificate from startssl.com and used there Nginx certificate. Does anyone know how I can fix this issue as it is holding me back from developing other features as I now can't use any part of my app till this is fixed.
Thank you in advance to anyone who can help me
You should use the certificate chain provided by your Certificate Authority, in the same time than your certificate, and follow the nxinx documentation:
https://nginx.org/en/docs/http/configuring_https_servers.html#chains
cat www.example.com.crt bundle.crt > www.example.com.chained.crt
And in your server block:
ssl_certificate www.example.com.chained.crt;
I have Android 4.3 forced to use Charles proxy via IPTABLES.
The charles certificate is installed on the phone.
I am able to capture normal SSL traffic like https websites in the browser.
All POST and GET methods seem to work fine.
In a particular app, it fails when using the SSL CONNECT method.
URL: https://XX.XX.XXX.XXX/
Status: Failed
Failure: SSLHandshake: Received fatal alert: unknown_ca
Response Code: - Protocol: HTTP/1.0
Method: CONNECT
From iOS 10.3 you also need to go to Settings > General > About > Certificate Trust Settings and trust Charles certificate.
You can face with this problem at some applications like Facebook or Instagram.
Charles certificate doesn't work at some new apps because they are using a technique named as SSL-PINNING. First of all you have to break ssl-pinning system of application or you can instal old version of application then it sometimes works but we need a new solution about ssl pinning in order to record traffic for this kind of applications.
as #Berkay Yıldız says, it probably using ssl/certificate pinning.
how to fix/avoid/disable ssl pinning?
the whole logic is:
LEVEL 1: for normal http：
core logic：
PC：Mac/Windows
Charles set http proxy
set port
app use Charles proxy
inside Wifi, set
host IP
port
Note：
computer side, MUST use wired network, NOT wireless, otherwise mobile side network not usable
LEVEL 2: for encrypted https：
PC
install Charles root certificate
Mac：use Key Chain to trust Charles Root CA
Charles
Enable SSL Proxying
set location filter for your specific api address
phone
app
install Charles Root CA
Note: type should select: VPN and Application
NOT select：WLAN
makesure certificate install successfully
Trusted Credentials -> User, can see installed Charles certificate
LEVEL 3: for SPECIAL https which using ssl pinning:
Phone：
make sure root or jailbreak
Android：has rooted
for later to install tool: Xposed
iOS：has jail break
for later to install tool: Cydia
then install plugin/tool, capable of avoid/disable ssl pinning
Android：
JustTrustMe (based on Xposed)
Android-SSL-TrustKiller (Cydia Substrate)
iOS：
SSL Kill Switch 2 (based on Cydia)
old version：iOS SSL Kill Switch (based on Cydia)
more detailed summary please refer my post (written in Chinese): 1 and 2
Some folks my end up here with android N Devices that won't do SSL over charles even after installing the cert - now on http://chls.pro/ssl
In N - you need to also add an xml file and security config. This post goes into more details: How to get charles proxy work with Android 7 nougat?
I have met the same problem. And after installing the latest certificate, it is solved.
On your phone, visit http://charlesproxy.com/getssl to download the cert. Upon downloading the cert in android, it will prompt you to install the cert, give the cert a name and continue. It should now work.
Note: The sshould be similar on an iPhone
I got the following error when I was trying to install the cert on my Nexus 6p, Android 6.0. (I followed the instructions in charles and downloaded the cert via http://chls.pro/ssl.):
Couldn't install because the certificate file couldn't be read.
The solution to this problem was to install via:
Settings > Security > Install from storage
After navigating to the cert file and installing it everything worked as expected.
On this link http://www.charlesproxy.com/documentation/using-charles/ssl-certificates/ you have all the information you need on properly installing the Charles certificate.
After installing it you'll get rid of the "SSLHandshake: Received fatal alert: unknown_ca" error.
If you get this with an app using facebook login on an android phone, I got around it by uninstalling the fb app. Then the mobile fb web is used instead and I can charles everything. With the fb app installed the fb api fails with SSL error.
On Samsung phones, you should install the certificate by navigating to Biometrics and security/Other security settings/Install from device storage/CA Certificate.
I am using Charles 4.2.5 and Nexus 6P on Android 8.1.
One cannot use Charles to track https on my mobile phone.
Plz note that after Android N, we cannot capture normal SSL traffic of others'app.
Here is the official website of Charles.
https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/
Android As of Android N, you need to add configuration to your app in
order to have it trust the SSL certificates generated by Charles SSL
Proxying. This means that you can only use SSL Proxying with apps that
you control.
In order to configure your app to trust Charles, you need to add a
Network Security Configuration File to your app. This file can
override the system default, enabling your app to trust user installed
CA certificates (e.g. the Charles Root Certificate). You can specify
that this only applies in debug builds of your application, so that
production builds use the default trust profile.
Add a file res/xml/network_security_config.xml to your app:
Then add a reference to this file in your app's manifest, as follows:
...