I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates generated by Burp Suite's CA.

The application also uses client certificate pinning. The application generates a new certificate (private, public key). The first request to the server is a Certificate Sign Request, which includes the login credentials and the newly generated certificate's public key. The server normally responds by approving the request, however if I run the Android emulator through Burp Suite, the server responds with an error.

I have tried the following (via modifying the source code):

  • Hardcoding Burp CA's public and private key into the application instead of having it generate a new one on the fly. I also configured Burp to use this as a client certificate when talking the server. Without proxying, the application works as expected.

I do not understand, why the server rejects the proxied request, how does it know it didn't originate from the client? What happens during proxying that changes the request?

  • Keep in mind the certificate authentication will be done between the app and burp suite, and again between burp suite and the server. This means burp suite itself has to know to authenticate with a client certificate. I'm not sure how this is done or if functionality exists, but the client's certificate is certainly not making it to the server – multithr3at3d Jan 21 at 17:38
  • The title of your question is kind of misleading. Essentially you are asking of client certificates pose a problem when doing a SSL MITM by a proxy. Duplicate of Does mutual authentication have any impact on MiTM possibilities? – Steffen Ullrich Jan 25 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.