I am learning Burp Suite(Free Edition v1.6). I have set it up with the default settings. The proxy listener is listening to 127.0.0.1 on port 8080 and Certificate option is set to 'Generate CA-signed per-host certificates'. I am using Firefox 33.0.2 and have configured the proxy settings appropriately. When I try to browse to
https://www.facebook.com/, I get a 'This Connection is Untrusted' page, which is expected, understandable. I have options to 'Get me out of here!' and 'Add Exception'. Most other sites on SSL also do the same. Except, that I encounter a somewhat different behavior when I try to browse to
https://www.twitter.com/. I get a 'This Connection is Untrusted' page, but this time without an option to 'Add Exception'. In both cases the Technical Details indicate the same issue.
www.***.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer)
Please note that I know I can import Burp's CA as a trusted CA in my browser, but what I am wondering in the specific case of twitter do I not get the option to add the certificate as an exception. This behavior is consistent across at least the 2 browsers that I have tested - Firefox and Chrome.
UPDATE I have disabled the certificate pinning option in Firefox, and I still see the same results.
UPDATE 2 The option to add the certificate as an exception is there, but hidden with the following code -
<h2 xmlns="http://www.w3.org/1999/xhtml" hidden="true" id="expertContent" class="expander" collapsed="true"> <button onclick="toggle('expertContent');">I Understand the Risks</button> </h2>
But why in the world does Firefox decide to do this? Even after "certificate pinning" is disabled.