1

Because of how https works as the following picture explains I would assume fiddler acts like a middle-man, intercept the requests from mobile, decrypt and re-encrypt to the real servers, then decrypt and re-encrypt the responses to mobile. Otherwise how can it capture all the https traffic?

how https works

I face a problem that fiddler can only capture the https traffic for an app I am developing from my iPhone but fails to capture from my android. My android app always complains "The server returns invalid data" for the very first https request. I would assume the server here means fiddler. I have not figured why that happened. And I tried many times on my android, occasionally fiddler can capture traffic but when it worked I did not figured out what I did differently. So I have 2 questions here.

  1. Does my assumption about fiddler acting as middle-man correct ? Otherwise how can fiddler (or any other app) capture https traffic ?

  2. Has anyone experienced the android error I hit? Any idea how to fix it?

android error

I search SO and find this one Some androids apps won't connect through fiddler may be related to my question. The answer there said

The main problem is that if you install the Fiddler root CA certificate in Android it is marked as user certificate (not system certificate). And unless explicitly configured in an app those user certificates are not trusted.

I did remember after I installed the fiddler CA on my iPhone I need to full trust it to make it work. But on Android I can't find a place to trust the CA. But that also can't explain why it works occasionally.

Qiulang
  • 10,295
  • 11
  • 80
  • 129
  • Yes I read your answer as I added in my question. But I don't think I need a rooted android. As I said occasionally fiddler can capture my https traffic. – Qiulang Apr 20 '22 at 09:43
  • 1
    Please re-read my answer: It depends on the app. If the app accepts user CA certificates (e.g. Chrome for Android) then it will work otherwise not. But if you want a device that fully works for intercepting there is only the possibility of a rooted device. The CA certificate itself is fine, it is just the way how you install it. – Robert Apr 20 '22 at 11:08
  • @Qiulang did you figure it out? The app i'm using works fine, but i don't see any requests on charles proxy for this app – Meir Dec 12 '22 at 21:53
  • @Meir it has been a while but I remembered I just can't make android work, please check this discussion I had on fiddler support https://community.getfiddler.com/support/discussions/topics/12000028218 – Qiulang Dec 14 '22 at 02:10

0 Answers0