1

Is there a way to get OWASP ZAP to send a client certificate?

I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. Previously, when I went to the website (in Firefox), I would be prompted to select one of the installed certificates. I would then be authenticated with the website as the user associated with the certificate.

However after setting up the browser to use a proxy, I am no longer prompted to select a certificate and then the browser just displays this message:

"400 Bad Request
No required SSL certificate was sent
nginx/1.10.2"

It looks like I need to get OWASP ZAP to send the certificate in place of the browser or, somehow, get the browser to force ZAP to forward the certificate. Is there some way for me to do this? Is this something that ZAP supports?

Edit: My setup works like this: There are three components. Firefox, OWASP ZAP and a Selenium project. Previous, it was just Selenium and Firefox. The application I am testing has multiple users with different roles. The Selenium test cases involve logging in as one user, performing a task as that user (which generates work for another user), logging in as the next user, performing work as that user etc. Each user has its own certificate to log in.

Previously, I created multiple Firefox profiles (one for each user) and added a single certificate for each profile. When I accessed the site with one of these profiles, the browser would default to the single certificate. Selenium could then switch between users by closing the old browser and opening a new one with the correct profile.

Right now, I use ZAP by opening the appropriate browser profile, setting the proxy to localhost:8080, starting the ZAP GUI, and then running the Selenium test which uses the aforementioned profile. Latter I manually set the contexts, run the spider and switch to Attack Mode. Thus far, I have been helped in getting ZAP to use a single certificate at a time, which has been a significant change.

2

You should be able to add any certificates that you need to use via the ZAP Options / Certificate screen (https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsCertificate).

  • Thank you, sir! That was so easy, I am embarrassed I asked the question. Now to find out if it is possible to get an automated process to switch between active certificates. It looks like we have to manually change that. If it is possible, it looks like I have a starting point. – harrys Aug 17 '18 at 21:12
  • Using the API? If not can you explain how you'd like it to work? – Simon Bennetts Aug 20 '18 at 7:11
  • I am not using the API, if I understand what you mean. I am using GUI. An API sounds ideal for what I am trying to do and I feel embarrassed that I came here before learning how to use it. If it has a means of starting ZAP (in the background or otherwise), storing certificates, setting the active certificates, setting contexts etc. then this is probably the solution. I edited my post to include a description of my setup. – harrys Aug 20 '18 at 20:06
  • TBH I think it would be better to shift this conversation to the ZAP User Group: groups.google.com/group/zaproxy-users - the original question is answered, but this thread could be very useful for other people looking ti use ZAP in a similar way :) – Simon Bennetts Aug 21 '18 at 7:50
  • Alright. I created a topic there summarizing the discussion here. Thanks for your help! – harrys Aug 21 '18 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.