I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid to route traffic through my proxy, for which I have used both Fiddler and Charles. However, I get different results with the two proxy server softwares.
With Fiddler I was not able to intercept traffic and my app fails to connect to the server. I even manually imported the Fiddler root certificate into /system/etc/security/cacerts and verified that it shows up in the system truststore, but still my app behaves as it should.
With Charles, however, I didn't even need to import the root certificate to my Android phone. Out of the box, I was able to intercept all SSL traffic between my app and my server.
So my question is, how is it possible for Charles to accomplish this even though Fiddler is not able to?