In order to man-in-the-middle (MITM) a TLS application, you need to make it trust the certificates issued by your MITM reverse proxy.
For some Android applications, it is enough to install the certificate authority (CA) root certificate of your MITM reverse proxy. This might however not be enough for some applications:
- if the application implements additional verification on top of the existing ones (certificate pinning) or implements its custom logic;
- if the application targets an SDK higher or equal to 24;
- if the application does not use the Android libraries for certificate verification at all.
For the second case, your might want to check out the Android documentation (emphasis mine):
By default, secure connections (using protocols like TLS and HTTPS)
from all apps trust the pre-installed system CAs, and apps targeting
Android 6.0 (API level 23) and lower also trust the user-added CA store by default.
Another interesting source is a post of the NCC group (emphasis mine):
if the application targets an SDK higher or equal to 24,
only the system certificates are trusted.
If the HTTPS traffic needs to be intercepted,
then a proxy certificate must be installed,
but it is going to be installed in the ‘user certificates’ container,
which is not trusted by default.
One solution is to instrument (patch) the application in order to disable the certificate verifications. This can be done ahead of time (by patching the APK) or at runtime (fbut you might need to use a rooted device in this case).
For case 1 and case 2, you could use: