2

Following my previous question (it's still unanswered if you have an idea...), I tried to set the proxy explicitly in the Java code. When doing this, I finally see in Fiddler the request tunnel (A SSLv3-compatible ClientHello handshake was found...), but still not the request itself. However, instead of response 200 which I receive when not using proxy, the following error is thrown:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

In short, my primary goal is to automate a login process via emulating web browser behavior (in terms of headers & post parameters). I managed to do it with a native Java application on PC, but the exact same code returns 400 in some request on Android (probably because the HttpUrlConnection class implementation is totally different in Android compared to Oracle SDK's), so I wanna capture the outgoing traffic and find the difference(s). I successfully got the requests sent from my PC and now struggling with Android.

Android device browser requests are captured successfully, the problem occurs only with applications (specifically my app). I installed the Fiddler certificate on device and set the WiFi proxy as required.

I also tried it on two devices, one of them is rooted, to no avail.

Any help will be appreciated!

Some code:

Proxy proxy = new Proxy(Proxy.Type.HTTP, new InetSocketAddress("192.168.0.120", 8888)); //My PC IP on local LAN
conn = (HttpsURLConnection) url.openConnection(proxy);
conn.setRequestMethod("GET");
conn.setUseCaches(false);
conn.setRequestProperty(...)               //Repeating thie line to add headers
int responseCode = conn.getResponseCode(); //Exception is thrown in this line
Community
  • 1
  • 1
Neria Nachum
  • 1,519
  • 1
  • 20
  • 37

1 Answers1

1

The chances are Fiddler root certificate didn't get installed correctly. To verify that try capturing in Fiddler HTTPS traffic from the device browser. If it doesn't work out here is plenty of information on troubleshooting custom CA - How to install trusted CA certificate on Android device?

Another approach is setting up your connection to trust Fiddler CA programatically. Create a custom KeyStore containing Fiddler root CA and initialize a TrustManager with that KeyStore. Then use the TrustManager to initialize an SSLContext and use the SSLContext provided SSLSocketFactory with your HttpsURLConnection.

Community
  • 1
  • 1
TsviatkoYov
  • 297
  • 1
  • 5
  • In one of the guides I followed, it says "It will ask you to choose a name for the certificate... When it asks what to apply it to, 'VPN and Apps' or WiFi, choose WiFi". However, when choosing WiFi the certificate is not added. With the other option it does, but the exception remains. Do you think it might be related? – Neria Nachum Jul 14 '16 at 12:17