Questions tagged [https]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

Adguard HTTPS filtering

Are there any Reviews/audits verifying the security of the Adguard HTTPS filtering (interception)? I know that any MITM software is a security risk, but without this feature ads are not blocked on ...
0
votes
0answers
30 views

Extracting user-installed certificate

I have a rooted Android 9 device that has a couple of user-installed CA certs installed that I'd like to extract. When I open Settings -> Security -> Encryptions & Credentials -> Trusted ...
0
votes
0answers
49 views

Sniff Android protected app HTTPS requests

I am going to capture an app's HTTPS request to get its Login API. I am using Fiddler. When inputting the username and password and pressing sign in, the app is working. But in Fiddler, I can not find ...
3
votes
1answer
170 views

How can I view a TLS 1.2 only website on an outdated tablet?

I have a tablet from 2011 (Prestigio MultiPad PMP3384B) with Android 2.3 which I use occasionally. I’ve experienced recently that I cannot view some webpages (https://www.nytimes.com/, for example) as ...
1
vote
1answer
82 views

Is there a way to capture HTTP requests from an installed Play Store app?

I'm developing a search aggregator service so I'd like to get the endpoint of some of the stores that, currently, doesn't expose their API. So I'd like to now if there's a way to do this with my ...
6
votes
1answer
255 views

Let's Encrypt: Is there a workaround for the 2021 SSL “cutoff” for pre-7.1.1 Android devices?

In January 2021 all devices with Android prior to 7.1.1 will not be able to connect to HTTPS servers using Let's Encrypt certificate (Let's Encrypt blog post explaining the details) Is there any ...
0
votes
0answers
62 views

Checking Android Certificates

I recently purchased a Galaxy A51. I noticed certificates that were located in the Credntial Storage in User Certificates. 10164_KNOX_Enhacened_Attestation Enhacened_Attestation_SSL FindMyMobile Are ...
3
votes
3answers
17k views

How to Bypass Certificate Errors in Google Chrome Android?

Apparently desktop Chrome has a flag called --ignore-certificate-errors that allows you to bypass all certificate warnings. Is there an equivalent for Android Chrome? I checked in chrome://flags but ...
0
votes
0answers
238 views

Install Self Signed SSL Certificate on Android 9.0

I am hosting a website on my LAN and its running on HTTPS via a self signed certificate. On my other windows devices i have added this self signed certificate as a Trusted Root Certification ...
1
vote
1answer
151 views

SSL error on Firebase hosting on old Android devices

I am not being able to see my Firebase Web App on old Android Devices due to SSL error. There is a question about this, but the answer doesn't say how to solve it. Is there any solution for this?
0
votes
1answer
6k views

How to resolve “enter the password for credential storage” issue?

So I am playing around with fiddler web proxy. I need to decrypt https traffic. So I am trying to put the fiddler root CA cert in my device trust store. But it keeps asking me "Enter the password for ...
0
votes
0answers
146 views

Android 10 user CA file not being used in apps

I'm using an ISP that does internet filtering for me, I have install their CA file, and it works in the browser, and used to work in all apps. After the latest update for Xiaomi Redmi Pro 9, Youtube, ...
0
votes
0answers
95 views

import pem file containing multiple CA certs

Using Samsung S4, Android 5.0.1, not rooted. Recently I have found at least two websites that the Chrome browser on Android 5.0.1 reports https is not secure. This is because the phone does not have ...
0
votes
0answers
171 views

How to convert certificate to be used in Android

I have generated a public - private keypair (CA is true) using the following code: openssl genrsa -out private.key 3072 openssl req -new -sha256 -out keys.csr -key private.key openssl x509 -...
0
votes
0answers
34 views

Is it possible to have shell access to Trusted Certificates

I have an Android Application that launches Python via JNI. Inside of Python I have web requets that I make, some need to be secure. I can configure the APK to be able to access a User CA certificate, ...
1
vote
1answer
309 views

How to inspect HTTPS traffic of a third-party app on Android 9+

I want to inspect inside HTTPS-encrypted packets that an app is sending. It is not my app, I don't have its source code. My device is rooted, so I can modify /system/etc/security/cacert if needed, ...
1
vote
1answer
451 views

Unable to install a modified apk file

I want to monitor the https traffic of an Android app downloaded from google play. This app can only be run at Android N and above. So I use Charles proxy and follow this document to modify the apk ...
0
votes
0answers
35 views

Changing third-party websites on android device without browser extensions available

I'm searching a way on how to change behavior of some website in mobile browser. For example: Remove annoing Ad (specific one) Change some elements on a website, to make it easier to read on small ...
0
votes
0answers
37 views

Montoring network traffic on Android phone (for research user study)

For context: We would like to analyze user mobile online (browsing) behavior in a user study. The study has been approved by our university's IRB, participants will have to give informed consent and ...
0
votes
0answers
199 views

Connecting to own proxy with self-made CA certificate not (properly) working

I have a Squid proxy installed with HTTPS/SSL support. When I install the generated CA certificate in Firefox and set the proxy, everything looks good -- that is, I can see all the HTTP(S) requests ...
1
vote
0answers
609 views

HTTP/HTTPS Transparent Proxy on Android

So on linux, I use transparent mode of mitmdump (mitmproxy without interaction) to build a websites filter and I run it as root on startup so that it cannot be killed if the user does not have sudo ...
2
votes
1answer
5k views

How to set Wi-Fi HTTPS proxy, not HTTP, via adb shell?

For HTTP I found a link: How to set WIFI proxy via adb shell? But I want to setup HTTPS proxy via adb shell.
0
votes
0answers
967 views

SSL certificates not updated on old Android

I have an old Android smartphones. More and more websites stop working because my chrome browser doesn't trust the root CA (Outdated or missing CA certificates). Obviously the root CA list is only ...
22
votes
3answers
48k views

How do I install a user certificate?

I have my own Root certificate that signs user certificates. I have a site that will only allow you on with a user certificate which is signed by the root ca. I have managed to get this site working ...
0
votes
0answers
106 views

Why I couldn't monitor traffic from this page?

When I opened the capture log I found nothing from the page other than this when I first tried to visit it using http only, and then I get that security warning and i click proceed to unsafe anyway i ...
1
vote
0answers
735 views

Cannot connect to HTTPS sites due to device clock being ahead

I cannot access 'My Search.com' I just set as my homepage (Brave browser) and Yandex for my search engine (new install). I got an error saying that my (device) time is ahead. Your clock is ...
1
vote
1answer
2k views

Is there a web browser for the 1st generation Kindle Fire that uses TLS1.2 or higher?

Various websites are starting to fail to load in the built-in Silk web browser, and I've tracked the issue down to the fact that Silk uses only TLS 1.0. TLS 1.0/1.1 is outdated and insecure to such ...
4
votes
1answer
7k views

Android support for TLS

I have found that TLS1.1 and TLS1.2 is supported from API level 16 and on by default from API level 20. This corresponds to Android 4.1 (supported) and Android 4.4W (wearable) or Android 5.0 (on by ...
2
votes
3answers
11k views

Where to get OpenSSL binary for Android?

I have a Nexus 10 (unlocked & rooted) and I wanted to get the openssl binary on there so I can verify HTTPS certificates: $ openssl s_client -connect <IPADDRESS> However, no matter what I ...
7
votes
2answers
931 views

How does Android handle wifi root CAs? Should they be a security concern?

My university requires me to install a custom root CA to connect to their wifi network. When I installed it on my phone, it let me specify "Wifi" or "VPN and apps". I chose wifi, and was able to ...
22
votes
1answer
79k views

What Trusted Root CAs are included in Android by default?

There doesn't seem to be a central Android resource that lists the Trusted Root CAs included in the OS or default browser (related question on SO), so how can I find out which are included on my phone ...
0
votes
1answer
91 views

HTTPS websites slow on Phone

I am trying to investigate why our Phones are experiencing slow browsing to HTTPS sites. It happens only the first time after the phone in question has been locked for a couple of minutes or more. So ...
1
vote
0answers
757 views

Bypassing certificate pinning with integrity checks on Android 7 (Nougat) or newer

How can I bypass Certificate Pinning, or bypass SSL verification entirely, in an Android app on Android 7 or newer that has a built-in hash 'integrity check' to rule out APK modification? Here is a ...
1
vote
2answers
5k views

Setting up an HTTPS proxy

I use proxifier to connect to an HTTPS proxy on the PC, what should I do in order to connect similarly on my Android smartphone? My Android version is 4.3, Jelly Bean.
1
vote
0answers
1k views

Can't visit “ https ” sites with an Android device using Wi-Fi

I have a strange problem on one of my old phones. I have an old Android device running Android 2.3.4, and it works perfectly. But, I found that, it can't access to https sites with the basic browser ...
0
votes
0answers
60 views

Does anyone know what this android emulator call is?

I've been looking at the network traffic for an Android emulator using mitm proxy. I have noticed large amounts of traffic going to google's servers. Does anyone know what this request would carry ...
1
vote
0answers
131 views

Removed trusted CA's now can't use Google…Anything!

My boyfriend accidently hit the 'Remove all stored credentials' and now he can not access anything Google, but most importantly the Play Store. OK it might have been on purpose, don't ask, but now it'...
0
votes
1answer
130 views

Is K-9 Mail susceptible to MITM attacks?

I am using K-9 Mail on Android and have set the SSL option to 'SSL (strict)'. My understanding is that with this option K-9 definitely requires a valid SSL certificate which is issued by a trusted CA,...
0
votes
1answer
110 views

Watch whether an app uses TLS

I'd like to inspect the network usage of my apps (e.g., a banking app) to determine the security protocols they employ (if HTTPS: TLS layer version, encryption protocol, key size, signature algorithm, ...
0
votes
1answer
2k views

Can't open non HTTPS websites on mobile network. (Android Lollipop on Nexus 5, Nexus 4)

I recently updated my Nexus 5 to Lollipop. The problem is that when I am on a mobile network, I can ONLY open HTTPS websites. All the HTTP websites appear as a blank white page. When I am on WiFi, ...
5
votes
0answers
2k views

How to remember/cache a client certificate

I support a web-application that requires an https connection with client certificates as part of the authentication scheme. On most browsers (Desktop clients, iOS Safari, etc) if you are prompted for ...
3
votes
1answer
7k views

Decrypting HTTPS Traffic from Android Apps via Fiddler?

I am actually trying to debug all the traffic going in and out on my phone. I am using Fiddler on my PC, and ProxyDroid on my phone to do this. HTTP traffic works fine. I am able to decrypt it ...
1
vote
0answers
749 views

How are certs validated against default trust store?

Through some reading, I have a fairly rough understanding about how https works with Android apps, especially how are certificate validations done. Some of the resources that I referred to for gaining ...
0
votes
1answer
1k views

Import/Install SSL-certificate without CA-flag

Our team has the following problem: We are developing a client-application for android and iOS using Unity + UniWebview + HTML. This app includes Ajax-requests to some servers via jQuery. For testing ...
1
vote
1answer
1k views

Using Gmail app on a public WiFi

Does official Gmail app use a secure connection? This post above discussing whatever Gmail using a secure connection, but is it relevant to a public WiFi connection? Or in public WiFi, is there a ...
1
vote
0answers
174 views

Why is Chrome on Android sending my HTTP requests to an IP owned by DoD?

When I make http requests to my website with Chrome Browser on android 6.0 (Nexus6) I saw that it is making requests to 130.90.151.44 instead of the IP of my webserver. If I use another browser, it ...
18
votes
1answer
31k views

self-signed certificate install claims success, but android acts as if cert isn't there

I am trying to install the self-signed certificate for my web server in Android 4.3. I have the .crt file in the root of the SD card (which is actually emulated as I have no SD card in the slot). To ...
2
votes
1answer
3k views

Connection to home server via https – works with WiFi, but not with 3G

I have a very weird issue with my phone (Alcatel 997D running Android 4.0.4). Let me start at the beginning. I provide certain services (mostly syncing stuff, Firefox and Cal/CardDAV) on a server with ...
0
votes
1answer
2k views

Unable to accept SSL certificate (k9mail)

I am setting up k9mail on a 4.2 device (rooted Sony Xperia Mini Pro with stock ROM and crap removed) and it complains about the IMAP SSL certificate not being valid. This happens with both a self-...
1
vote
1answer
2k views

Android does not download any files from untrusted CA certificate site

I work on a site that serves mobile phones and shares some file. When I publish my site in http everything works great. But when I activate SSL and publish my site via HTTPS with my own certificate, ...