I'm working on a project that retrieves images from different servers (http and https).
I found this usefull Q/A to avoid the problem of No peer certificate error in Android 2.3, but i can't understand why in Android 4 (>3) this problem ("No peer certificate error") was not presenting.
Please, correct me if I'm wrong:
In Android 2.3 an HTTPS connection performs the whole certificate checks (and handshakes);
In Android > 3 the HTTPS connection is established even if the handshake fails (Ex: my app, as the peer, has not the certificate).
What are the differences between these version of Android?
Why I need to Trust all in Android 2.3 and not in Android 4?
Why in Android 2.3 I receive the following Exception: "javax.net.ssl.SSLPeerUnverifiedException: No peer certificate error"
while in Android 4 everything works fine and the connection is established?
Is everything related to SNI Server Name Indication, introduced in Android Honeycomb?
Your certifying authority probably is not listed in the 2.3.3 version of Android, but is in the 4.x version. To find out for sure check the keystore on both devices.
Using ADB from the command line you can dump out android's keystore to a file and check to see if that issuer is available in your keystore (may need to be root).
adb pull /system/etc/security/cacerts.bks cacerts.bks
Download and install Portecle (from: http://portecle.sourceforge.net/)
Select File / Open Keystore... and choose the cacerts.bks file.
Select Tools / Keystore Report and copy that information into a text editor to look for the CN specified in the certificate found from the web browser. In my case I couldn't find one from "Cybertrust Public SureServer SV CA".
Browse to the website you are interested in using https://example.website.com/ on your computer web browser and find out who the CN is. Compare that to the keystore as shown above. If it is not in the keystore you will need to add it.
NOTE: Android 4.0 phones have a different method for storing certificates and don't use the cacerts.bks file mentioned below. For them you should be able to open the desired https site in the web browser and add the desired certificates that way.
I had connection issues to facebook and redbox. To fix my problem and update my android 2.3.3 phone certificates I copied the one from the android 3.2 emulator and put that on my phone:
Create and start an android 3.2 virtual device.
Copy the cacerts.bks file from the emulator (make sure your other device is not connected).
adb pull /system/etc/security/cacerts.bks cacerts.bks
Disconnect the emulator.
Connect your device to be updated (must be root). You may need to remount the /system folder as rw for read/write capabilities. For mounting issues, see: this link
Save a copy of the old cert file from your device:
adb pull /system/etc/security/cacerts.bks cacerts.bks.old
Put the updated cert file on your device
adb push cacerts.bks /system/etc/security/
Reboot the device
Reconnect and verify the new cacert file was loaded.
Related
I am using an android emulator (Pixel_3a_API_32_arm64-v8a) and need to install Charles Proxy there. As per the step I have already set up the wifi settings(i.e change proxy to manual and then set up the proxy hostname and proxy port in the wifi setting). Also, I have downloaded the SSL certificate using http://chls.pro/ssl. But on trying to install it I am getting an error in my android emulator.
Error
This certificate from null must be installed in Settings. Only install CA certificates from organizations you trust.
On recent Android versions, it's no longer possible to install system certificates, and installing user certificates is much harder. It's not possible to just open the file normally to install it, and apps can't show you any prompts to trigger installation either.
For more details on the change and how this works, see https://httptoolkit.tech/blog/android-11-trust-ca-certificates/
The actual steps you need are:
Open settings
Go to 'Security'
Go to 'Encryption & Credentials'
Go to 'Install from storage'
Select 'CA Certificate' from the list of types available
Accept a large scary warning
Browse to the certificate file on the device and open it
Confirm the certificate install
I have followed instructions on how to add fiddler certificate on android emulator, using both nox and memu emulators, as well as my android phone running marshmallow, I set the WiFi proxy to point to my PC over the local network, when I open a website using a web browser, things work fine, I receive the warning, I choose to proceed and the connection is successfully tunneled and decrypted using fiddler.
But, when I try to use other apps, connections fail! I see the tunnel connections, and then connection fails. My bet is, it's due to the invalid HTTPS certificate, so my question is, is there a way for me to install fiddler to the trusted authorities so connecting to it will go through without the warning? So I can finally debug HTTPS traffic from and to those apps.
I found similar questions here on SO, but none of them were exactly the same as mine, nor did they have the right answers, so I'm not sure if this question does in fact qualify as a duplicate.
Thanks
On modern Android devices using apps developed for target API Level 24 (Android 7) or higher sniffing traffic is not that simple anymore. The target API level of an app is defined it's AndroidManifest.xml file in the entry <uses-sdk android:targetSdkVersion="??"/>.
The main problem is that if you install the Fiddler root CA certificate in Android it is marked as user certificate (not system certificate). And unless explicitly configured in an app those user certificates are not trusted.
One of those rare apps that respect user CA certificates is Chrome. So using Chrome for testing if the proxy and the installed root CA certificate works is a bad idea, as it may only work in Chrome but not for apps.
Note that some apps further use certificate pinning (leaf or root CA pinning). Therefore even if the Fiddler root CA certificate is installed as system certificate the app won't trust this certificate as it fails on the certificate pinning.
Certificate pinning is also a web site feature, hence some sites save a certificate hash in the web browser cache that pins the site to a certain certificate. In such a case clearing the browser cache is usually removing those pinning data.
Rooted devices
If your device is rooted you can try to install the Fiddler root CA certificate as system certificate. The Mitmproxy documentation contains a how-to for manually installing the mitmproxy certificate.
If you have rooted the phone using Magisk, there is a Magisk module that seems to be able to install user certificates automatically as system certificates: https://github.com/NVISO-BE/MagiskTrustUserCerts
Alternatively you can install Magisk + Edxposed + TrustMeAlready Xposed module. This allows to disable certificate checking system wide - WARNING: this eliminates the security of SSL/TLS against active attacks, for all apps on the phone. Therefore only do this on a device you use just for hacking!
Also possible is installing and run Frida-Server on the device and hook into the app you are interested to modify the SSL/TLS certificate checking at run-time. AFAIK the Frida based framework Objection has some scripts to do so.
Non-rooted device
On a non-rooted device there is only the option to modify the application before you install it onto the device. Note that some apps will detect that they have been modified and will refuse to work.
To let the app trust user certificates you have to modify network_security_config.xml (see e.g. here) included in the app. You can use apktool to decompile/recompile the app. Don't forget to re-sign the recompiled/repackaged app e.g. using apksigner from Android SDK.
There are some tools available that automate the decompiling , modification and signing like apk-mitm.
There is also the possibility to modify an app by including the Frida gadget for Android into the app. This would allow to use Frida for this specific app on a non-rooted device.
I have followed instructions on how to add fiddler certificate on android emulator, using both nox and memu emulators, as well as my android phone running marshmallow, I set the WiFi proxy to point to my PC over the local network, when I open a website using a web browser, things work fine, I receive the warning, I choose to proceed and the connection is successfully tunneled and decrypted using fiddler.
But, when I try to use other apps, connections fail! I see the tunnel connections, and then connection fails. My bet is, it's due to the invalid HTTPS certificate, so my question is, is there a way for me to install fiddler to the trusted authorities so connecting to it will go through without the warning? So I can finally debug HTTPS traffic from and to those apps.
I found similar questions here on SO, but none of them were exactly the same as mine, nor did they have the right answers, so I'm not sure if this question does in fact qualify as a duplicate.
Thanks
On modern Android devices using apps developed for target API Level 24 (Android 7) or higher sniffing traffic is not that simple anymore. The target API level of an app is defined it's AndroidManifest.xml file in the entry <uses-sdk android:targetSdkVersion="??"/>.
The main problem is that if you install the Fiddler root CA certificate in Android it is marked as user certificate (not system certificate). And unless explicitly configured in an app those user certificates are not trusted.
One of those rare apps that respect user CA certificates is Chrome. So using Chrome for testing if the proxy and the installed root CA certificate works is a bad idea, as it may only work in Chrome but not for apps.
Note that some apps further use certificate pinning (leaf or root CA pinning). Therefore even if the Fiddler root CA certificate is installed as system certificate the app won't trust this certificate as it fails on the certificate pinning.
Certificate pinning is also a web site feature, hence some sites save a certificate hash in the web browser cache that pins the site to a certain certificate. In such a case clearing the browser cache is usually removing those pinning data.
Rooted devices
If your device is rooted you can try to install the Fiddler root CA certificate as system certificate. The Mitmproxy documentation contains a how-to for manually installing the mitmproxy certificate.
If you have rooted the phone using Magisk, there is a Magisk module that seems to be able to install user certificates automatically as system certificates: https://github.com/NVISO-BE/MagiskTrustUserCerts
Alternatively you can install Magisk + Edxposed + TrustMeAlready Xposed module. This allows to disable certificate checking system wide - WARNING: this eliminates the security of SSL/TLS against active attacks, for all apps on the phone. Therefore only do this on a device you use just for hacking!
Also possible is installing and run Frida-Server on the device and hook into the app you are interested to modify the SSL/TLS certificate checking at run-time. AFAIK the Frida based framework Objection has some scripts to do so.
Non-rooted device
On a non-rooted device there is only the option to modify the application before you install it onto the device. Note that some apps will detect that they have been modified and will refuse to work.
To let the app trust user certificates you have to modify network_security_config.xml (see e.g. here) included in the app. You can use apktool to decompile/recompile the app. Don't forget to re-sign the recompiled/repackaged app e.g. using apksigner from Android SDK.
There are some tools available that automate the decompiling , modification and signing like apk-mitm.
There is also the possibility to modify an app by including the Frida gadget for Android into the app. This would allow to use Frida for this specific app on a non-rooted device.
I'm trying to setup a local dev environment for a PWA I'm working on.
I have installed mkcert on my Mac and am able to host a https://localhost version on my computer.
Now I'd like to open the page on my Android phone. On the mkcert github it says:
Mobile devices
For the certificates to be trusted on mobile devices,
you will have to install the root CA. It's the rootCA.pem file in the
folder printed by mkcert -CAROOT.
On iOS, you can either use AirDrop, email the CA to yourself, or serve
it from an HTTP server. After installing it, you must enable full
trust in it. Note: earlier versions of mkcert ran into an iOS bug, if
you can't see the root in "Certificate Trust Settings" you might have
to update mkcert and regenerate the root.
For Android, you will have to install the CA and then enable user
roots in the development build of your app. See this StackOverflow
answer.
https://github.com/FiloSottile/mkcert
I installed the rootCA.pem on my phone. The part about "enabling user roots" doesn't apply, since this is not an app.
But when I open the page on my phone using https://[my-local-network-ip]:1234 I get a warning, that the certificate can't be trusted.
How can I trust the certificate so I can locally test the PWA on my phone?
I know you've probably moved on from this question, as it's almost a year on. However, I would like to share how I was able to test my PWA locally in a secure context.
Not making any assumptions about what framework / packaging / build system you're using:
Generate a certificate & key using mkcert. If you are hosting your PWA locally & want to access it over your local IP address i.e. 192.168.1.x:3000 you also need to tell mkcert to generate a certificate that covers that IP address:
mkcert localhost 192.168.1.17
// The certificate is at "./localhost+1.pem" and the key at "./localhost+1-key.pem" ✅
Important note: most routers dynamically assign local IP addresses, so it's worthwhile assigning a static IP.
Install your RootCA from mkcert onto your iOS or Android device. Follow the instructions in the mkcert docs
Serve your generated certificates with your web server of choice. I use Create React App. You can see my answer about PWAs in secure context here
I agree with your goal - running a local TLS based setup can be useful in terms of productivity and early troubleshooting.
Your problem is DNS based and you need to access the TLS secured URL via the host name.
The only way you'll get DNS to match up on the Android side is to use an HTTP proxy, while running either an emulator or a device connected via USB.
In a nutshell I would do this:
Issue your cert to a more real world domain name such as mycompany.com
Add this domain name to DNS on your Mac book
Install a free proxy such as proxyman on the Mac
Configure the Android emulator or device to use the proxy (you will also need to trust the proxy's cert on Android and the Mac)
Then browse to https://mycompany.com from Android
Full details are available in my write up
I followed this guide on how to create my own CA and end entity certificates. My certificate authority (localhost) openssl config looks very similiar to this. According to this post I've set
[ v3_ca ]
basicConstraints = CA:TRUE
On my desktop devices there are no problems at all and https works fine.
Problems occur when I try to install the root certificate on my android device.
At first I installed the root certificate via the inbuilt 'install from storage' option (Settings / Security / Credential storage). Https works now but I always get the network may be monitored warning.
Following this article I took the certificate hash, renamed the rootca.pem file to {hashid}.0 file as suggested and moved it to /system/etc/security/cacerts/ using ADB on windows powershell (also set chmod and chown).
After rebooting my phone I can see that my authority certificate has been successfully added to android native trusted certificate storage. It's active by default.
Now I got rid of the networking monitor warning but ssl is not working anymore. Android chrome on remote debug throws:
broken https certificate missing net::ERR_UNEXPECTED (firefox on android says SEC_ERROR_UNKNOWN_ISSUER)
Is there a way to get around this/install it correctly? Did I forget something?
For those interested I'm sharing the solution:
Here's what I did to solve this:
(1) flashing my sm-g900f with odin v3.12.4-4 and latest twrp 3.3.0-0-klte
(2) backup relevant data, wipe system/cache/... with twrp afterwards
(3) flash 16.0-nightly-klte addonsu-16.0-arm open_gapps-arm-9.0-nano-20190428
(4) install certificate via security settings options. Shown as 'user cert' but no warning message and ssl works now :)
Thanks to JW09I4 from XDA-Developers for helping me out and guiding me through the process of updating my phone.