4 ms·

Try fiddler. I've inspected my own HTTPS traffic a number of times using it including e.g. traffic from e.g. iPads where my Desktop was effectively acting as "

Try fiddler. I've inspected my own HTTPS traffic a number of times using it including e.g. traffic from e.g. iPads where my Desktop was effectively acting as "the edge device". Of course, this is more for debugging than aggregate statistics/monitoring... This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert, but it'll work fine for vanilla HTTPS / generic CA based stuff (e.g. all browser traffic.)

IncRnd 9y ago
> This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert Replacing a cert doesn't get around cert pinning. That is the exact use case that cert pinning protects against.
- tzahola 9y ago
  They meant replacing the cert fingerprint in the app that’s using cert pinning.
  - IncRnd 9y ago
    That makes sense. Thank you.
- fiddlerwoaroof 9y ago
  Couldn’t a mitm proxy just strip out the relevant headers?
  - IncRnd 9y ago
    It appears you're talking about pinning in browsers only, so I'll address from that perspective only. For public certs: Yes, but that would only produce the desired effect if the site hadn't yet been pinned, and this was a first connection, or in the case of the pins having expired. In other words, the pinning can only be stripped out if there is no pinning already in place on the client. However, this will soon be a moot point, as Chrome removes pinning in favor of cert transparency. This will reopen this security hole in browsers simply trying to be secure within captive portals and other insecure networks. Tor has pinning that would extend from inside the portal to outside, so that may be one option, but I don't yet know how sturdy that is.
andrewaylett 9y ago
Firefox at least will disable pinning if it sees a certificate signed by a user-supplied CA, on the one hand to facilitate this kind of debugging and on the other because otherwise enterprises using MITM boxes wouldn't be able to use Firefox. I suspect Chrome does too.
- detaro 9y ago
  Yes, all major browsers do that.

IncRnd 9y ago

> This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert Replacing a cert doesn't get around cert pinning. That is the exact use case that cert pinning protects against.

tzahola 9y ago
They meant replacing the cert fingerprint in the app that’s using cert pinning.
- IncRnd 9y ago
  That makes sense. Thank you.
fiddlerwoaroof 9y ago
Couldn’t a mitm proxy just strip out the relevant headers?
- IncRnd 9y ago
  It appears you're talking about pinning in browsers only, so I'll address from that perspective only. For public certs: Yes, but that would only produce the desired effect if the site hadn't yet been pinned, and this was a first connection, or in the case of the pins having expired. In other words, the pinning can only be stripped out if there is no pinning already in place on the client. However, this will soon be a moot point, as Chrome removes pinning in favor of cert transparency. This will reopen this security hole in browsers simply trying to be secure within captive portals and other insecure networks. Tor has pinning that would extend from inside the portal to outside, so that may be one option, but I don't yet know how sturdy that is.

andrewaylett 9y ago

Firefox at least will disable pinning if it sees a certificate signed by a user-supplied CA, on the one hand to facilitate this kind of debugging and on the other because otherwise enterprises using MITM boxes wouldn't be able to use Firefox. I suspect Chrome does too.

detaro 9y ago
Yes, all major browsers do that.