I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates generated by Burp Suite's CA.
The application also uses client certificate pinning. The application generates a new certificate (private, public key). The first request to the server is a Certificate Sign Request, which includes the login credentials and the newly generated certificate's public key. The server normally responds by approving the request, however if I run the Android emulator through Burp Suite, the server responds with an error.
I have tried the following (via modifying the source code):
- Hardcoding Burp CA's public and private key into the application instead of having it generate a new one on the fly. I also configured Burp to use this as a client certificate when talking the server. Without proxying, the application works as expected.
I do not understand, why the server rejects the proxied request, how does it know it didn't originate from the client? What happens during proxying that changes the request?