0

So I am working with Charles proxy server, I understand I can decrypt HTTPS traffic, if the user accepts the invalid cert warning on the browser or trusts charles as a root CA.

However what I have is, a real verisign cert, and private key off another server I own. So if I install that, technically the cert should be trusted by all clients already.

The problem I have after installing the cert into charles, is I still see the cert error on the client.

For example goign to facebook.com i see issued to: *.facebook.com (fine) issued by: xyz.com

(where xyz.com is the fqdn I got the cert off) Am I doing something wrong here?? Will this work?

  • Yeah you are right guys, nwo I think about it I understand it will never work. I was just confused why it said "issued by xyz.com" where as on xyz.com it would say issued by Verisign. – Flamer Feb 24 '16 at 2:34
3

It's doing exactly as it's designed to do. The Facebook Cert is designed to allow trusted connections only to domain names for Facebook. Your personal Cert is designed only to work for that personal domain. Just because you have a valid Cert doesn't allow you to spoof any domain you wish.

| improve this answer | |
1

Your browser is correctly giving you an invalid certificate error, because you pointed your browser to facebook.com, but the CN of the certificate that the browser sees is xyz.com. The two don't match, so your browser is showing a certificate error - as it should.

If this weren't the case, then anyone could MITM any site using any certificate, if they are able intercept the connection between the browser and the server (as you are doing with Charles).

| improve this answer | |
1

Like the other responses say, that Verisign cert will just work for your domain.

Charles can generate a Root Certificate that you would then export and place in your browser. (Help --> SSL Proxying --> Install Charles Root Certificate ) Each installation of Charles creates a unique certificate but you must take care to keep it secret.

Burp proxy is a similar tool to Charles and I use it to do the same thing. Unlike your Verisign cert, this root certificate will allow proxying of all https without any certificate warnings.

See http://www.charlesproxy.com/documentation/using-charles/ssl-certificates/

Note that you won't really be decrypting the traffic with Charles but intercepting it before it is decrypted on its way out of your system. With this root certificate you are not using it to decrypt but to verify the identity of the remote server (or, really, disable the browser's ability to try to validate the remote server. If you install this and, while proxying through Charles, go to a site masquerading as facebook, you will be tricked because your browser can't warn you that it isn't the real facebook.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.