2

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But issue arise when I've changed my ZAP certificate in ZAP Proxy. So with the new certificate on ZAP Proxy, the normal way to do was to install the certificate into my Android phone. But with an existing ZAP certificate in place, I can't do that.

If I attempt to remove the old ZAP certificate from /system/etc/security/cacerts , reboot, install the new certificate and reboot again, the certificate will not be shown inside the credential storage.

Moving on, I've tried to remove the new certificate and place the old certificate back and reboot, the certificate will now appear in the credential storage.

Why would I not choose to just import the old certificate into the new ZAP proxy? Because importing certificate into ZAP requires the format of both the certificate and unencrypted private key. (https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsDynsslcert)

I've actually encountered this issue not only with ZAP certificate but also with Burp certificate, trying to install a new certificate with the same name does not work. If anyone has any solution, please do help me.

For references: This is my steps inserting custom certificate into Android phone. (https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)

Improve this question
2

2 Answers 2

Reset to default
0

Convert the Owasp Zap certificate from .cer to .der using openssl or using web service for change the format (https://www.sslshopper.com/ssl-converter.html) and follow the same process that do you see in (https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)

Improve this answer
0

I never used OWASP ZAP certificate on an android but I can help with Burp Suite.

  1. I usualy export the burpsuite certificate as .der to my desktop ou I browse with the smartphone to the http://burp and download the certificate.
  2. Once the .der certicated is downloaded on any of the devices, I change the extension into .crt then I install the cert.crt int to the smartphone by pressing install on the certificate.
  3. Once the certificate is installed, I add the proxy IP Address on the android wifi settings and then I am able to intercept the traffic.

Please visit the portswigger website with the official instruction on how to install burp suite certificate on an android device. https://portswigger.net/support/installing-burp-suites-ca-certificate-in-an-android-device

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .