7

I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ProxyDroid set up, that transparently routes all web-seeking traffic through the ZAP proxy I've set up.

Browsing https sites via chrome on android, and accepting the ZAP certificate on the red warning page works well, and gives me un-encrypted sessions on ZAP. However, any other apps that communicate via ssl/https simply refuse to send any network traffic.

I would like to know how I can set up a 'universal' trusted CA certificate on my android device, that allows me to see the un-encrypted traffic on ZAP. My android device is rooted.

Let me know if the information I've provided is incomplete or not clear.

(Thanks)

Improve this question
10
  • Apps might have hardcoded certificates or thumbprints and only communicate with a server that has exactly the expected certificate. If an app works that way, the only way to get it to run with your certificate would be reverse-engineering and modifying it.
    – Flo
    Commented Jul 15, 2013 at 8:49
  • That is true, but I'd like to test for an easier case where apps are using certificates presented by the OS, before making assumptions about hardcoded certificates and thumbprints.
    – Hammad Akhwand
    Commented Jul 15, 2013 at 9:42
  • 5
    You could try installing the CA cert you created onto the device. Settings> Security> Trusted Credentials. There is a system store of trustede CAs that is created when the roms are built but you can upload user certs in p12 format which would include the ca cert. hope that helps some.
    – dudebrobro
    Commented Jul 15, 2013 at 13:07
  • 1
    @QuentinSwain has the right idea, but there technical obstacles to actually doing it in older Android systems (i.e., pre-4.0). See SO's How to install trusted CA certificate on Android device?, which links to an article that links to Android's bug tracker item "Provide support for managing CA and client certificates" which states it was added in ICS (4.0). Before 4.0, custom CAs were only used for VPN and Wifi, not websites or apps. (It may be possible on pre-4.0 with a rooted device.)
    – apsillers
    Commented Jul 15, 2013 at 13:20
  • 1
    @AJHenderson Sure, I just wanted to bring up the shortcomings of pre-4.0 custom CAs to save the OP some hair-pulling frustration, in case he was planning to use a pre-4.0 device for testing.
    – apsillers
    Commented Jul 15, 2013 at 13:56

2 Answers 2

Reset to default
4

You should be able to add a root certificate to the keystore in Android under the settings. Note that adding a certificate to the keystore will require a password or pattern lock to be turned on on the device. You can access the keystore under Settings/Security normally, though some customized versions of Android may have moved it a bit.

Improve this answer
2
  • I did try adding a root CA certificate in my device (Jellybean 4.2.2) via settings > security > Install from storage. But the apps still refused to communicate with their servers. Should I explicitly be specifying the app servers for whose traffic I want visible on ZAP, so that ZAP presents my certificate for those servers instead of just forwarding the traffic? Would such a setting even exist in ZAP?
    – Hammad Akhwand
    Commented Jul 16, 2013 at 5:11
  • 1
    I don't know your particular proxy, but if it doesn't include the proper site name in the certificate, it is going to still error. That may be the problem. It is also possible the application is running off it's own trusted root certificate in which case you might not be able to do anything.
    – AJ Henderson
    Commented Jul 16, 2013 at 13:08
2

There are a few strategies to intercepting HTTPS traffic from Android devices:

  • Install your certificate on the device (but you've already tried that).
  • If the app doesn't trust user certificates: Leverage root privileges to push your certificate to the system certificate store (/etc/security/cacerts) after converting it into the appropriate format
  • If the app performs certificate pinning: Use a tool like Frida to intercept the function calls responsible for certificate pinning and handle them. Once again, there is more than one way using Frida to do this.

Source: Personal research and experience.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .