Proxying android application traffic through burp when user certificates aren't trusted

Question

I'm testing an android application on a virtual machine running android x86 (android_x86_64-userdebug 9 PI eng.lh.20200325.112926 test-keys). In its current configuration, it does not trust user SSL certificates, and thus I cannot proxy the application traffic through a Burp proxy on the same network. (Visiting https://example.com through the proxy with Chrome works just fine).

I.e. I configure the device to proxy all traffic through my Burp proxy, but when the application attempts to connect to the remote server it fails. Reading the output of tcpdump I see a message of TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Certificate Unknown).

If I attempt to add the certificate to the Trusted root certificates in /system/etc/security/cacerts/<8bytesig>.0, l get a notification from the OS telling me that a third party has added a certificate to my device. I can then move it being a User certificate, which doesn't help me.

My question is, given root access to an Android x86 device, how do I add a trusted root certificate such that it is actually trusted by the device as a root certificate instead of as a user certificate?

Answer 1

On Android 6 and below the system trusted user certificates, but as you say on newer android versions user certificates are not trusted in general.

What you need to do is to install the burp certificate as a root certificate. To do this the certificate must be in the correct format and have the correct name. Assuming you have the burp certificate at hand with the name burp.cert run the following commands to convert it to PEM format and give it an appropriate name:

openssl x509 -inform der -in burp.cer -out certificate.pem
cp certificate.pem `openssl x509 -inform pem -subject_hash_old -in certificate.pem | head -1`.0

To install the certificate you need to start your emulator with a writable system. If you're using the Android Studio emulator that would be something like:

./emulator -avd yourAvd -writable-system

If you are on Android 10 or above you also need to disable verified boot to be able to install the certificate:

adb root
adb shell avbctl disable-verification
adb reboot

After the emulator has rebooted you can proceed to copy the certificate to the emulator and install it:

adb root
adb remount
adb shell
cp /sdcard/Download/9a5ba575.0 /system/etc/security/cacerts/
chmod 644 /system/etc/security/cacerts/9a5ba575.0
reboot

You of course need to 9a5ba575.0 with the name of your certificate. After this everything should be working. It's important to be aware that you have to start your emulator with a writable system whenever you want to use the certificate. If you don't do that the certificate won't be available.

I've also written about this process in a bit more detail in a blog post.