1

Is there a way to get OWASP ZAP to send a client certificate?

I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. Previously, when I went to the website (in Firefox), I would be prompted to select one of the installed certificates. I would then be authenticated with the website as the user associated with the certificate.

However after setting up the browser to use a proxy, I am no longer prompted to select a certificate and then the browser just displays this message: 

"400 Bad Request
No required SSL certificate was sent
nginx/1.10.2"

It looks like I need to get OWASP ZAP to send the certificate in place of the browser or, somehow, get the browser to force ZAP to forward the certificate. Is there some way for me to do this? Is this something that ZAP supports?

Edit: My setup works like this: There are three components. Firefox, OWASP ZAP and a Selenium project. Previous, it was just Selenium and Firefox. The application I am testing has multiple users with different roles. The Selenium test cases involve logging in as one user, performing a task as that user (which generates work for another user), logging in as the next user, performing work as that user etc. Each user has its own certificate to log in.

Previously, I created multiple Firefox profiles (one for each user) and added a single certificate for each profile. When I accessed the site with one of these profiles, the browser would default to the single certificate. Selenium could then switch between users by closing the old browser and opening a new one with the correct profile.

Right now, I use ZAP by opening the appropriate browser profile, setting the proxy to localhost:8080, starting the ZAP GUI, and then running the Selenium test which uses the aforementioned profile. Latter I manually set the contexts, run the spider and switch to Attack Mode. Thus far, I have been helped in getting ZAP to use a single certificate at a time, which has been a significant change.

Improve this question

1 Answer 1

Reset to default
2

You should be able to add any certificates that you need to use via the ZAP Options / Certificate screen (https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsCertificate).

Improve this answer
6
  • Thank you, sir! That was so easy, I am embarrassed I asked the question. Now to find out if it is possible to get an automated process to switch between active certificates. It looks like we have to manually change that. If it is possible, it looks like I have a starting point.
    – harrys
    Aug 17, 2018 at 21:12
  • Using the API? If not can you explain how you'd like it to work?
    – Simon Bennetts
    Aug 20, 2018 at 7:11
  • I am not using the API, if I understand what you mean. I am using GUI. An API sounds ideal for what I am trying to do and I feel embarrassed that I came here before learning how to use it. If it has a means of starting ZAP (in the background or otherwise), storing certificates, setting the active certificates, setting contexts etc. then this is probably the solution. I edited my post to include a description of my setup.
    – harrys
    Aug 20, 2018 at 20:06
  • TBH I think it would be better to shift this conversation to the ZAP User Group: groups.google.com/group/zaproxy-users - the original question is answered, but this thread could be very useful for other people looking ti use ZAP in a similar way :)
    – Simon Bennetts
    Aug 21, 2018 at 7:50
  • Alright. I created a topic there summarizing the discussion here. Thanks for your help!
    – harrys
    Aug 21, 2018 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .