1

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But issue arise when I've changed my ZAP certificate in ZAP Proxy. So with the new certificate on ZAP Proxy, the normal way to do was to install the certificate into my Android phone. But with an existing ZAP certificate in place, I can't do that.

If I attempt to remove the old ZAP certificate from /system/etc/security/cacerts , reboot, install the new certificate and reboot again, the certificate will not be shown inside the credential storage.

Moving on, I've tried to remove the new certificate and place the old certificate back and reboot, the certificate will now appear in the credential storage.

Why would I not choose to just import the old certificate into the new ZAP proxy? Because importing certificate into ZAP requires the format of both the certificate and unencrypted private key. (https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsDynsslcert)

I've actually encountered this issue not only with ZAP certificate but also with Burp certificate, trying to install a new certificate with the same name does not work. If anyone has any solution, please do help me.

For references: This is my steps inserting custom certificate into Android phone. (https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)

  • So did you root your phone? – James K Polk May 17 '18 at 18:07
  • @JamesKPolk Yes. Using Magisk. – Leroy Tam May 17 '18 at 23:37
0

Convert the Owasp Zap certificate from .cer to .der using openssl or using web service for change the format (https://www.sslshopper.com/ssl-converter.html) and follow the same process that do you see in (https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.