I'm trying to MitM an Android Application for research purposes (it's designed to be broken).
I'm using Burp as an attack proxy and already exported the Burp CA certificate and imported it into the Android CA store.
I also tried 3 different tools that promise to break certificate pinning (Android-SSLTrustKiller and others).
However every time I set my Burp as proxy, the app throws the following error in logcat:
09-14 20:18:07.446: W/System.err(2478): javax.net.ssl.SSLHandshakeException:
checkServerTrusted: Expected public key: 30820122300d06092a864886f70d0......
My best guess is that the Java "Environment" is using different certificate settings than the rest of the Android OS.
I can already decode the browser or Google maps just fine.
So how can I get Java to ignore the certificate pinning?