HTTPS filtering breaks some apps

Question

I have enabled HTTPS filtering in AdGuard. I installed AdGuard's certificates, and the Magisk module that moves the certificates to the system store. Nevertheless, some apps don't work. Why is this? If the certificate is in the system store how can they tell the difference? Also is there a way to tell which apps actually use HTTPS?

Answer 1

Most likely this happens because the apps not only perform certificate validation but also certificate pinning.

For certificate validation the validity of the server certificate and the certificates of the certificate chain (this is what you can bypass by installing the custom root CA certificate).

In addition, apps can do certificate pinning: The app includes a check if the used root CA certificate is the expected one. As the companies are buying their server certificate, they exactly know which CA certificate the connection should use. If the app then finds the AdGuard root CA certificate, the connection is rejected. A certificate pinning check cannot be bypassed without modifying the code of the app.

I know that Google (e.g. Play Store) and Facebook (various apps) use this certificate pinning to prevent breaking HTTPS connections.

Bypassing certificate pinning is possible on rooted devices, if the app is not too obfuscated. Those tools are usually based on LSPosed/Xposed or Frida. If AdGuard breaks all HTTPS connections, you could use TrusteMeAlready or JustTrustMe and enable it only for problematic apps (note that those modules not only try to disable pinning but also disable TLS security completely, so it is important that AdGuard intercepts those connections).

For Frida, there are various scripts that can disable pinning in some apps. A nice article about Frida and certificate pinning can be found here: Defeating Android Certificate Pinning with Frida

Answer 2

I use Adguard but haven't come across any problematic apps. To supplement Robert's answer, Adguard knowledgebase What is HTTPS filtering says

However, HTTPS filtering has its drawbacks. The most important one is that it hides from the browser the actual certificate of the website. Instead, the browser sees the certificate issued by AdGuard.

(Emphasis supplied)

While it talks of web based Adguard, the concept remains the same for Android apps. The only solution I see for such apps is to exclude those apps from Adguard using the app management icon in the center of icons displayed at bottom.

Maybe the latest version of the app (4.3) addresses this issue? Though from the release notes I don't see anything related, except for one specific app, which this release fixed.

You may as well raise the issue of the problematic apps in the Adguard forum for them to address, just as they did for the app linked above.