Why some iphone apps won't finish ssl handshake with Charles Proxy?

Question

I am using Charles Proxy to see all of the traffic that is coming out of my iphone. I have the ssl certificate/profile installed on my iphone and I can see a lot of the traffic that is ssl encrypted. However, some applications seem to not finish the ssl handshake.

The error is: "SSLHandshake: Remote host closed connection during handshake" and then Charles Proxy suggests to configure the application to trust the Charles Root Certificate. I thought I did when I installed the profile onto my iphone?

Any explanation of this/way to fix it?

Solution 1

There are applications which don't simply expect the certificate signed one of the trusted CA's on the system, but which expect a single specific certificate or a certificate containing a specific public key. This is called certificate/public key pinning. For this application it will not work if you configure the CA of Charles Proxy as trusted on the system because they will not use this CA.

Any explanation of this/way to fix it?

If the application is built to only trust a single certificate/public key and never trust something just because it is signed by a locally trusted CA, then you would need the original certificate and its private key to do the SSL interception. Since you don't have these there is no way to do the SSL interception.

Solution 2

Yes, SSL pinning is a possibility. Although as of iOS 10.3, you must take an additional step to trust the Charles Root Certificate that is not currently documented on their website edit: this info is now under iOS Devices here: https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/

Settings > General > About > Certificate Trust Testings

Source: https://www.neglectedpotential.com/2017/04/trusting-custom-root-certificates-on-ios-10-3/

Comments

[Aero Wang]

What a shame. I think I am having the same problem here while I tried to reverse engineer an iOS app.

[harmeet07]

I downloaded the SSL certificate and installed it. Once I trusted it it worked great.

[Fidan Hakaj]

Thanks! It did the job

[Scott Zhu]

they should add this to the documentation

[Wingzero]

This is an answer you wish never skipped

[Besi]

This is now documented on the Charles website: charlesproxy.com/documentation/using-charles/ssl-certificate‌​s

[charmingToad]

I find there are still some websites that won't accept this... particularly apple-related, such as opening the app store on an iPad (probably pinning, like you said).

[Talk is Cheap Show me Code]

I agree with that some apps dont accept this, also the same issue with fiddler. they simply through the error that the client certififcate can not be trusted and ask to switch to another network. May be pinning is the issue.

[Talk is Cheap Show me Code]

I am still wondering is there really a way to bypass the certifiacte validiton checking?

[Ray Luxembourg]

What to do if some connections are still not working?

[Peter Schorn]

This does not always resolve the issue, especially if you are trying to intercept the traffic of a third-party app that uses certificate pinning.