Develop Reference

Android 12 Mobile device http/https traffic is not recorded in Jmeter

Please find the steps I followed when recording the mobile device traffic
Connect the Jmeter(version 5.5) installed lap top and the Mobile device (Samsung galaxy Android 12) in same wifi network (same subnet)
Setup the lap top's ip address(ipconfg command) in mobile wifi settings as manual proxy.
Setup the Jmeter setup port in mobile wifi settings as manual proxy - port.
Note - Traffic is allowed through mentioned port via Firewall (inbound rule)
click start button in jmeter's HTTP(S) Test Script Recorder.
Import the jmeter CA certificate (generated in jmeter bin folder) in to mobile device.
Install it through Settings >> Biometrics and security >> Other security settings >> Install from device storage >> CA certificate >> Accept the warning and install
Login to browser from mobile and search any keyword(default samsung browser, cleared browser cache)
Observe the results recording in jmeter result tree.
Observation - No any traffic from mobile is recorded.
below logs are recorded only in jmeter console
Please help to know the reason how this issue need to be resolved.

I don't think these steps are sufficient for Android 12, you need to additionally follow the steps from Network security configuration page of Android documentation in order to instruct your application to trust JMeter's CA certificate.
add the next line to the application section of your app manifest
android:networkSecurityConfig="#xml/network_security_config"
create network_security_config.xml file under your app resources folder with the following content
<?xml version=“1.0” encoding="utf-8"?>
<network-security-config>
<debug-overrides>
<trust-anchors>
<!-- Trust user added CAs while debuggable only -->
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>
build your app in debug mode
replace the app in the device with the debug .apk from the previous step
More information: Configure Android Devices for Proxy Recording

I found the solution by myself.
Solution:
Originally the network profile of my lap top was set as Public. see below.
Then I changed it to "Private". problem was resolved for me with that.
Thanks.

Unable to view HTTPS requests in Charles Proxy with Android

I am trying to debug an app on the Google Playstore so that I can see the requests that it is sending out. I've set up Charles Proxy on my computer to help me do so, but I am having issues with viewing requests sent out with https. My steps are listed below.
My Computer:
Manjaro Linux
My Phone:
Google Pixel 4a
Android 11
Not rooted
My Settings:
Using Charles v4.6.1
Proxy Settings
SSL Proxying Settings
My Access Control Setting's contain my phone's IP.
My Phone Settings:
Proxy Settings
Certificate
Here are my steps to allow the app use SSL through charles:
Download the app from the Google Playstore.
Find the apk and transfer it to my PC, and then uninstall the app through the Google Playstore.
Decompile the apk using Apktool from XDA Forums.
According to this and this, I need add the following lines below inside <network-security-config> inside the network security xml.
<debug-overrides>
<trust-anchors>
<certificates src="user"/>
</trust-anchors>
</debug-overrides>
The AndroidManifest.xml already follows the required changes, so I don't make any changes there.
I compile the decompiled contents into an apk.
I sign the built apk with Uber Apk Signer.
I transfer the built and signed apk to my phone, and install it.
I do not get any errors at any step though this list.
Here is a screenshot of my view in Charles.
Thank you in advance, and please let me know if you need any more details.

Your network config there is within <debug-overrides>, which only applies for debug builds. Did you build the application in debug mode, or for production? If you don't build in debug mode then that config won't apply.
You probably want to use <base-config> instead, which applies to all builds, not just debug builds. There's a full example here: https://httptoolkit.tech/docs/guides/android/#if-you-dont-have-a-custom-network-security-config.
If that doesn't work, then it's likely that there's some certificate pinning in place in the application code itself, independent of the network security settings. To fix that you'll need to manually edit the code itself. You can also try using https://github.com/shroudedcode/apk-mitm which has a selection of automated patches that disable many common manual pinning implementations for you.

Stuck in Charles Proxy Certificate Installation for Android TV / Fire TV

We started working on Android TV recently and we need to connect charles proxy tool for ease of development process. We were able to set proxy on tv using same wifi connection.
But we are not getting any way to install the charles trusted certificate in Android tv. We tried various approach but could not get any working one:
We tried pushing certificate to android tv, but there was no way ahead to install certificate kept in tv storage.
We could not find "Install Certificate" option in advanced wifi which is available in android phones. We used this option in mobiles to install certificate kept in local device storage.
We tried setting proxy and then we were trying to open www.charlesproxy.com/getssl on chrome to download and install certificate, but this approach was also not working. We were not able to launch chrome via google assistance because of proxy enabled.
We tried approach provided in the url:
how to install CA certificate programmatically on Android without user interaction
But the above approach was not working. The commands were giving permission denied issues. We don't want our android tv to be rooted.
Kindly help us with a way to install the trust certificate. Any help would be really appreciated.!!

I think that you probably already solved your problem, but for somebody else that is still struggling with this you can try:
Export the certificate from Charles app. usually named 'charles_ssl_proxying_certificate.pem'
Add that certificate as a raw file to you android project. (src/res/raw)
Create a new resources folder 'xml' (probably you already have it)
Create a new xml file called 'network_security_config.xml'
Paste this content within that new file
<network-security-config>
<base-config>
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
<debug-overrides>
<trust-anchors>
<certificates src="#raw/charles_ssl_proxying_certificate"/>
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>
Add this line to you androidManifest for the application tag
android:networkSecurityConfig="#xml/network_security_config"
If you have already configure the proxy on your AndroidTV this should be enough

It sounds like you have not configured the app to trust the SSL certificate generated by Charles - see the Android section in the SSL Certificates guide.

Charles SSL Proxy works for chrome but not for the apps

I'm using Nexus 5X device running Android 7. I failed to setup the proxy using the recent instructions from Charles Proxy documentation. I installed certificate, but wifi settings or nugat are extended. I can set charles as a certificate but that won't let me connect to that wifi (authentication problem). So I leave it as "don't check correctness". I don't even know if that's relevant.
The thing is when I try to sniff on my app https calls I see SSLHandshake: Received fatal alert: certificate_unknown
However if I run a web client using chrome on the same device - I can read calls to the same api.
The bottom line is it works for a browser but not for my app. I checked on other apps aswell. Same output.
The reason I ask here is because maybe I have to add some unsafe client to my retrofit api setup - hopefully not.

Here is how you need to configure you apk in order to make CharlesProxy work in Android 7.
Android
As of Android N, you need to add configuration to your app in order to have it trust the SSL certificates generated by Charles SSL Proxying. This means that you can only use SSL Proxying with apps that you control.
In order to configure your app to trust Charles, you need to add a Network Security Configuration File to your app. This file can override the system default, enabling your app to trust user installed CA certificates (e.g. the Charles Root Certificate). You can specify that this only applies in debug builds of your application, so that production builds use the default trust profile.
Add a file res/xml/network_security_config.xml to your app:
<network-security-config>
<debug-overrides>
<trust-anchors>
<!-- Trust user added CAs while debuggable only -->
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>
Then add a reference to this file in your app's manifest, as follows:
<?xml version="1.0" encoding="utf-8"?>
<manifest ... >
<applicationandroid:networkSecurityConfig="#xml/network_security_config" ... >
...
</application>
</manifest>
Here you can find more details:
https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/

In Charles, select Help -> SSL Proxying -> Install Charles Root Certificates in IOS Simulators, close the iOS Simulator and restart the simulator. It should work now.

How to get charles proxy work with Android 7 nougat?

Android 7 introduced some changes to the way certificates are handled (http://android-developers.blogspot.com/2016/07/changes-to-trusted-certificate.html) and somehow I cannot make my Charles proxy work any more.
My network_security_config.xml:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config>
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
<debug-overrides>
<trust-anchors>
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>
I'm running in debug mode. But no matter what, I get javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found..
Needless to say, I did install a pfx certificate from Settings -> Security -> Install from storage. The certificate shows in User Credentials but not in Trusted credentials -> User. On my lollipop device, the certificates are listed there.
I'm using okhttp3 as HTTP library.
Any idea what I am doing wrong ?

The solution is do not use .p12, just navigate with Chrome (with configured proxy on wifi) to http://charlesproxy.com/getssl and install downloaded .pem file.
I had exactly the same problem on my Nexus 5X running Android 7.0.
There was previously exported .p12 from Charles 3.11.5 (Help->SSL Proxying->Export Charles Root certificate and Private key). When I tried to install .p12 from phone (Settings->Security->Install from storage) it appears only under "User credentials" and never at "Trusted credentials", and of course SSL with Charles proxy did not work.
The total "how-to" for Android 7.0 would be like that:
Configure WiFi + proxy (how Charles requires it). Connect it.
On device, navigate with Chrome to http://charlesproxy.com/getssl, accept request for download .pem, then press "open", it launches "Certificate installer" app. Use it to install the certificate as "VPN and apps".
Put the attribute android:networkSecurityConfig="#xml/network_security_config" to <application> at Manifest.xml
Create res/xml/network_security_config.xml with content from the first post (it is totally correct).
Launch Charles and app and have fun.
P.S. Check date/time on the device. It should be correct.

Based on the troubleshooting thread of comments for the OP, the answer is to install just the proxy's CA cert as trusted, not its cert + private key.
The issue was caused by two factors:
Installing not just the MiTM proxy's CA cert but also its private key (thus enabling VPN apps on the device to decrypt/MiTM network traffic from other apps). You don't need the MiTM proxy's private key on the device.
Android Nougat change in behavior of the Settings -> Security -> Install from storage flow for files which contain a private key in addition to cert(s). This change in behavior unmasked the above issue.
Prior to Nougat, the Settings -> Security -> Install from storage flow for files containing a private key in addition to certs erroneously installed the certs as trusted for server authentication (e.g., HTTPS, TLS, thus making your MiTM succeed), in addition to being correctly installed as client certs used for authenticating this Android device to servers. In Nougat, the bug was fixed and these certs are no longer installed as trusted for server authentication. This prevents client authentication credentials from affecting (weaking) the security of connections to servers. In your scenario, this prevents your MiTM from succeeding.
What complicates matters is that the Settings -> Security -> Install from storage does not provide an explicit way for the user to specify whether they are installing a client authentication credential (private key + cert chain) or a server authentication trust anchor (just a CA cert -- no private key needed). As a result, the Settings -> Security -> Install from storage flow guesses whether it's dealing with client/user authentication credential or server authentication trust anchor by assuming that, if a private key is specified, it must be a client/user authentication credential. In your case, it incorrectly assumed that you are installing a client/user authentication credential rather than a server authentication trust anchor.
P. S. With regards to your Network Security Config, you should probably configure the app to also trust "system" trust anchors in debug mode (debug-overrides section). Otherwise debug builds of the app won't work unless connections are MiTM'd by a proxy whose CA cert is installed as trusted on the Android device.

I also had the same error and tried every way until I read the following message which was key: "The certificate shows in User Credentials but not in Trusted credentials".
So the problem was how to make the certificate appear there and these were the steps I followed:
Download the certificate in the emulator from http://chls.pro/ssl
Install the certificate & Trust
Setting app -> Security -> Encryption & Credentials -> Install a Certificate -> Select CA Certificate option
Select Install Anyway
Select Charles Proxy Certificate that you downloaded on your storage
Verify that you're trusted the certificate
Open Trusted Credentials -> User Tab and you can see your certificate here
Start intercepting HTTPS Traffic

For me SSL proxy was not working in release build variant. In debug worked.

I'm on Android 7.1.1, here's how I setup on my device (OnePlus One) - without the change of manifest (I was targeting API 21 for my app):
In Charles Proxy:
Help > SSL Proxying > Install Charles Root Certificate on a Mobile Device or Remote Browser. This steps gives you the proxy IP and port number and also the link to where you should download charles proxy SSL.
On your phone:
Wifi Settings > Modify Network > Advanced Options. Set Proxy to Manual and enter the IP and Port number you received from Charles into Proxy hostname and Proxy port respectively.
(OPTIONAL) You may or may not be able to access the chls.pro/ssl link provided by Charles earlier. On my device, I was always notified that I had no network connection. I added the charlesproxy.com to the Bypass proxy for field.
On your browser, go to the link in step 3 and download whatever certificate necessary (if it doesn't work on Chrome, download Dolphin Browser).You can name your certificate with whatever name.
Back on Charles Proxy:
You should get the prompt to either Allow or Deny your phone to use the proxy if your settings is defaulted to prompt you for remote connections.
You can now use Charles on Nougat 7.1.1.