1

I am learning Burp Suite(Free Edition v1.6). I have set it up with the default settings. The proxy listener is listening to 127.0.0.1 on port 8080 and Certificate option is set to 'Generate CA-signed per-host certificates'. I am using Firefox 33.0.2 and have configured the proxy settings appropriately. When I try to browse to https://www.facebook.com/, I get a 'This Connection is Untrusted' page, which is expected, understandable. I have options to 'Get me out of here!' and 'Add Exception'. Most other sites on SSL also do the same. Except, that I encounter a somewhat different behavior when I try to browse to https://www.twitter.com/. I get a 'This Connection is Untrusted' page, but this time without an option to 'Add Exception'. In both cases the Technical Details indicate the same issue.

www.***.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer)

Please note that I know I can import Burp's CA as a trusted CA in my browser, but what I am wondering in the specific case of twitter do I not get the option to add the certificate as an exception. This behavior is consistent across at least the 2 browsers that I have tested - Firefox and Chrome.

UPDATE I have disabled the certificate pinning option in Firefox, and I still see the same results.

UPDATE 2 The option to add the certificate as an exception is there, but hidden with the following code -

<h2 xmlns="http://www.w3.org/1999/xhtml" hidden="true" id="expertContent" class="expander" collapsed="true">
      <button onclick="toggle('expertContent');">I Understand the Risks</button>  
</h2>

But why in the world does Firefox decide to do this? Even after "certificate pinning" is disabled.

3

This is a security feature called certificate pinning (or public key pinning). In this case the browser knows which certificate (or public key) to expect and refuses any attempts to override it by the user. Twitter is included for public key pinning since Firefox 32.

See https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning for more details.

  • As per the blog, since Firefox 33, even Google sites use this feature. But I do get the option to add an exception when browsing to www.google.com, then why not with twitter. – user1720897 Nov 4 '14 at 7:16
  • This is strange indeed. It would be interesting to see the differences between the certificates created by Burp. It would also interesting to know if you get this behavior with a fresh browser profile too. – Steffen Ullrich Nov 4 '14 at 19:35
  • 1
    This might be indeed an interaction between HSTS and pinning, altough I cannot find any documentation about it. Note, that www.google.com does not seem to be in the preloaded HSTS list while www.twitter.com is which might explain why you can override the first but not the second. – Steffen Ullrich Nov 5 '14 at 9:13
  • 1
    I've looked into the source code: dxr.mozilla.org/mozilla-central/source/security/manager/boot/… – Steffen Ullrich Nov 5 '14 at 11:25
  • 1
    mIncludeSubdomains, see top of file for the definition of the structure. – Steffen Ullrich Nov 5 '14 at 16:40
2

A bit of a painful workaround but it works for use with BurpSuite / Charles / Fiddler etc is to revert to Firefox 3 when you want to proxy the connection to HSTS sites: https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/3.0/win32/en-GB/

0

This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.