Since android 7, apps will not obey the user installed CA certificates anymore. So as a tester, if you want to test and verify issues such as certificate pinning you need to install the custom proxy certificate into android trusted root.
I made a research on this and found an article which does this. It basically suggests the following:
- Create a custom certificate using OpenSSL
- Convert the certificate to android compatible form (with SomeHash.0 extension)
- Move the certificate to android trusted root
adb pushand move the certificate to the proxy tool as well
- Change permissions and own the certificate by root user.
I did exactly everything mentioned in the article and yet didn't succeed. I could see my certificate installed in the Root CA store and I have manually checked and enabled it as well.
When I connect the proxy tool, I am able to intercept all the http traffic but no https traffic with HSTS enabled. I even deleted all the certificates in the trusted root and kept only my certificate. Still the same behaviour. What might have gone wrong?
I tested this with an android emulator running on Genymotion. I didn't try it on a real physical device. The emulator was Google pixel with Oreo 8.0.
I believe this is a much needed requirement for all the testers. So any helpful input is much appreciated.