0

Whenever I'm behind a man in the middle proxy such as burp, and try to access either google or facebook, I get an alert message telling me that the connection is not reliable and blocks the page from displaying.

I'm guessing it has something to do with security certificates. But how do they know not to trust the connection?

3
  • What browser are you using?
    – user49075
    May 6, 2015 at 5:36
  • Chrome and Firefox @RickyDemer
    – helloworld
    May 6, 2015 at 5:36
  • Google could easily do that with Chrome. I don't know why that happens in the other three cases.
    – user49075
    May 6, 2015 at 5:38

2 Answers 2

1

It may depend on how your certificate is installed.

If your client doesn't recognize your certificate, then there's your problem. Go read up on how certificates work to understand what's happening here.

If your certificate is installed as a globally-trusted root CA, then the browser will assume that a public CA is behaving badly again, and won't let the connection proceed. Don't install interception certificates like that. Chrome uses key pinning on select domains (including Google and Facebook) to prevent unauthorized certificates from being accepted.

If your certificate is installed as a locally-trusted authority, then Chrome (and probably firefox--not sure here) will allow the connection to proceed, even though the there is a pinned key for the domain. The reasoning is that the owner of the machine should have the last word, and Chrome will therefore respect your decision without second-guessing you.

1
  • Firefox also does this by default (being Firefox, it's configurable). Firefox also has its own cert store, so you need to add stuff there.
    – cpast
    May 6, 2015 at 6:15
3

These sites set the HSTS header (HTTP Strict Transport Security). If you have visited these site without the Burp proxy before, your browser knows (cached) the HSTS policy and sees a mismatch.

The HSTS Policy specifies a period of time during which the user shall access the server in a secure-only fashion.

HTTP Strict Transport Security (HSTS) is a web security policy mechanism which is necessary to protect secure HTTPS websites against downgrade attacks, and which greatly simplifies protection against cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections,1 and never via the insecure HTTP protocol. HSTS is an IETF standards track protocol and is specified in RFC 6797.

The HSTS Policy[2] is communicated by the server to the user agent via a HTTP response header field named "Strict-Transport-Security". HSTS Policy specifies a period of time during which the user agent shall access the server in a secure-only fashion.

In order to make this work, the HSTS settings should be removed from your browser, this is different per browser.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .