I'm trying to monitor the HTTP requests/responses made when performing a Windows Update.
I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp:
netsh winhttp import proxy source=ie
The proxy is running on another machine on port 8080 and is configured to intercept SSL.
I have tried both with Burp proxy or with a normal Squid proxy (using ssl_bump). The root CA certificates are installed on the Windows 8 machine, in the Local Machine store, under Trusted Root CAs. If I browse from IE or Chrome I can access https sites without a warning (as the presented server certificate is signed by the proxy CA).
However, if I try to use Windows Update I get an error:
"There was a problem checking for updates"
This is a known issue, Bluecoat advise adding an exception for SSL interception for Windows Update:
Microsoft make the same recommendation for TMG:
So it seems like the Windows Update service doesn't just check the certificate in the usual way, it actually verifies against a different CA list, or specifically requires a certain server certificate from the Windows Update site.
The question is, how can I work around this, so that I can see the HTTP requests made by Windows Update?