2

Since android 7, apps will not obey the user installed CA certificates anymore. So as a tester, if you want to test and verify issues such as certificate pinning you need to install the custom proxy certificate into android trusted root.

I made a research on this and found an article which does this. It basically suggests the following:

  1. Create a custom certificate using OpenSSL
  2. Convert the certificate to android compatible form (with SomeHash.0 extension)
  3. Move the certificate to android trusted root /system/etc/security/cacerts/ using adb push and move the certificate to the proxy tool as well
  4. Change permissions and own the certificate by root user.

I did exactly everything mentioned in the article and yet didn't succeed. I could see my certificate installed in the Root CA store and I have manually checked and enabled it as well.

When I connect the proxy tool, I am able to intercept all the http traffic but no https traffic with HSTS enabled. I even deleted all the certificates in the trusted root and kept only my certificate. Still the same behaviour. What might have gone wrong?

I tested this with an android emulator running on Genymotion. I didn't try it on a real physical device. The emulator was Google pixel with Oreo 8.0.

I believe this is a much needed requirement for all the testers. So any helpful input is much appreciated.

  • 1
    If the site uses HSTS and it is displayed in a WebView you also have to clear the HTST cache (or the complete app data of the app) if you have used the app at least once without MitM proxy. HSTS pins the certificate therefore adding a system ca cert is not enough in this case. – Robert Sep 4 '18 at 7:56
  • How did you convert the certificate to hash.0 file? Maybe your file's hash didn't match. – Aero Windwalker Apr 28 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.