I'm using burp suite as proxy and configured my browser to it. I'm able to intercept SSL connection traffic of only some web applications using self-signed certificate issued by burp by adding exception to my browser. But when I try to do the same to google, it does not initiate TLS handshake and we cannot add any exception (as there were no packets related to handshake checked in wireshark). Is there any client side validation before handshake is initiated?
There could be a few reasons for this, but the most likely are HSTS, SPDY, and preloaded pinning:
- HTTP Strict Transport Security (HSTS) is a mechanism by which a server can enforce that the server is only ever connected to via a secure connection (e.g. HTTPS) and that a valid certificate must be presented. Your browser will not allow the connection to initiate on an insecure protocol like plaintext HTTP, or if the presented certificate is not valid. You can't override this. If you're doing TLS MitM in Burp, your browser will reject the certificate as invalid unless you install the Burp CA in your browser.
- SPDY is an alternative HTTPS protocol that Google uses a lot. It may well be that your browser is trying to initiate a SPDY connection, and that's perhaps why Burp isn't catching it.
- Chrome comes preloaded with a set of server certificate rules for pinning. The idea is essentially that they preload HSTS rules for a bunch of common sites as part of the installer, but with the additional protection of including a fingerprint of the known certificate. This will cause any invalid certificates, even those with "valid" signatures (e.g. signed by a local CA), to be rejected.
My advice would be to install the Burp CA into your system's certificate store, and your browser if applicable. That should probably fix it.
I doubt that there is no SSL handshake because the browser will not know up-front which certificate it will get. But I'm sure there is no successful SSL handshake.
With google.com and any other sites protected by certificate pinning you will not be able to add an exception by design. What you need to do instead is to import the CA used by burp as trusted into the browser. This makes it also easier for all the other tests, since you will not need to add an exception for any other site afterwards since they are all considered trusted because they are signed by a trusted CA.