3

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But issue arise when I've changed my ZAP certificate in ZAP Proxy. So with the new certificate on ZAP Proxy, the normal way to do was to install the certificate into my Android phone. But with an existing ZAP certificate in place, I can't do that.

If I attempt to remove the old ZAP certificate from /system/etc/security/cacerts , reboot, install the new certificate and reboot again, the certificate will not be shown inside the credential storage.

Moving on, I've tried to remove the new certificate and place the old certificate back and reboot, the certificate will now appear in the credential storage.

Why would I not choose to just import the old certificate into the new ZAP proxy? Because importing certificate into ZAP requires the format of both the certificate and unencrypted private key. (https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsDynsslcert)

I've actually encountered this issue not only with ZAP certificate but also with Burp certificate, trying to install a new certificate with the same name does not work. If anyone has any solution, please do help me.

For references: This is my steps inserting custom certificate into Android phone. (https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)

2
  • So did you root your phone? Commented May 17, 2018 at 18:07
  • @JamesKPolk Yes. Using Magisk.
    – Leroy Tam
    Commented May 17, 2018 at 23:37

2 Answers 2

0

Convert the Owasp Zap certificate from .cer to .der using openssl or using web service for change the format (https://www.sslshopper.com/ssl-converter.html) and follow the same process that do you see in (https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)

0

I never used the OWASP ZAP certificate on an android but I can help with Burp Suite.

  1. I usually export the burpsuite certificate as .der to my desktop ou I browse with the smartphone to http://burp and download the certificate.
  2. Once the .der certificate is downloaded on any of the devices, I change the extension into .crt then I install the cert.crt int to the smartphone by pressing install on the certificate.
  3. Once the certificate is installed, I add the proxy IP Address on the android wifi settings and then I can intercept the traffic.

Please visit the Portswigger website with the official instructions on how to install the burp suite certificate on an android device. https://portswigger.net/support/installing-burp-suites-ca-certificate-in-an-android-device

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .