7

I have enabled HTTPS filtering in AdGuard. I installed AdGuard's certificates, and the Magisk module that moves the certificates to the system store. Nevertheless, some apps don't work. Why is this? If the certificate is in the system store how can they tell the difference? Also is there a way to tell which apps actually use HTTPS?

2 Answers 2

7

Most likely this happens because the apps not only perform certificate validation but also certificate pinning.

For certificate validation the validity of the server certificate and the certificates of the certificate chain (this is what you can bypass by installing the custom root CA certificate).

In addition, apps can do certificate pinning: The app includes a check if the used root CA certificate is the expected one. As the companies are buying their server certificate, they exactly know which CA certificate the connection should use. If the app then finds the AdGuard root CA certificate, the connection is rejected. A certificate pinning check cannot be bypassed without modifying the code of the app.

I know that Google (e.g. Play Store) and Facebook (various apps) use this certificate pinning to prevent breaking HTTPS connections.

Bypassing certificate pinning is possible on rooted devices, if the app is not too obfuscated. Those tools are usually based on LSPosed/Xposed or Frida. If AdGuard breaks all HTTPS connections, you could use TrusteMeAlready or JustTrustMe and enable it only for problematic apps (note that those modules not only try to disable pinning but also disable TLS security completely, so it is important that AdGuard intercepts those connections).

For Frida, there are various scripts that can disable pinning in some apps. A nice article about Frida and certificate pinning can be found here: Defeating Android Certificate Pinning with Frida

1
  • +1 i use Adguard too but surprisingly haven't come across any problems with Play Store as your answer indicates. Wonder why? //I added an answer to supplement yours
    – beeshyams
    Dec 25, 2023 at 6:41
2

I use Adguard but haven't come across any problematic apps. To supplement Robert's answer, Adguard knowledgebase What is HTTPS filtering says

However, HTTPS filtering has its drawbacks. The most important one is that it hides from the browser the actual certificate of the website. Instead, the browser sees the certificate issued by AdGuard.

(Emphasis supplied)

While it talks of web based Adguard, the concept remains the same for Android apps. The only solution I see for such apps is to exclude those apps from Adguard using the app management icon in the center of icons displayed at bottom.

Maybe the latest version of the app (4.3) addresses this issue? Though from the release notes I don't see anything related, except for one specific app, which this release fixed.

You may as well raise the issue of the problematic apps in the Adguard forum for them to address, just as they did for the app linked above.

1
  • 1
    I agree, bypassing certain apps and/or domains is a common workaround for dealing with certificate pinning when performing https interception. At least for common apps like Play Store which don't have large ad banners that could be filtered and that are essential for most users.
    – Robert
    Dec 25, 2023 at 11:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .