Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

so this breaks charles proxy HTTPS sniffing as well? I haven't encountered the problem yet even though my Android Chrome is version 101


It doesn't break Charles Proxy unless you installed your CA cert in a method that is typically used by httptoolkit (installing in the system store).

What is broken is installing a custom CA into the system store on a rooted phone and making it work with all apps (apks) and Chrome.

If you install the custom CA into the user store it'll still work with Chrome.

If you want to use Charles to inspect the HTTPS traffic of an app you are developing then you continue to follow the instructions from https://www.charlesproxy.com/documentation/using-charles/ssl... to configure your test build to use the user store CA certs.

If you want to use Charles to inspect apps from other developers then you need to rebuild them to trust the user store just like you would if you were developing the app yourself. Use https://github.com/shroudedcode/apk-mitm to automate that process.

httptoolkit uses the method they do because it was the easiest way to get setup to inspect everything. Its tedious to get every app setup to trust the user store.


> What is broken is installing a custom CA into the system store on a rooted phone and making it work with all apps (apks) and Chrome.

yep, that's what I do. still seems to work here though. I'm scared to reboot




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: