Why some iphone apps won't finish ssl handshake with Charles Proxy?

IosIphoneSslProxyReverse Engineering

Ios Problem Overview


I am using Charles Proxy to see all of the traffic that is coming out of my iphone. I have the ssl certificate/profile installed on my iphone and I can see a lot of the traffic that is ssl encrypted. However, some applications seem to not finish the ssl handshake.

The error is: "SSLHandshake: Remote host closed connection during handshake" and then Charles Proxy suggests to configure the application to trust the Charles Root Certificate. I thought I did when I installed the profile onto my iphone?

Any explanation of this/way to fix it?

Ios Solutions


Solution 1 - Ios

Yes, SSL pinning is a possibility. Although as of iOS 10.3, you must take an additional step to trust the Charles Root Certificate that is not currently documented on their website edit: this info is now under iOS Devices here: https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/</b>

Settings > General > About > Certificate Trust Testings

Source: https://www.neglectedpotential.com/2017/04/trusting-custom-root-certificates-on-ios-10-3/

Solution 2 - Ios

There are applications which don't simply expect the certificate signed one of the trusted CA's on the system, but which expect a single specific certificate or a certificate containing a specific public key. This is called certificate/public key pinning. For this application it will not work if you configure the CA of Charles Proxy as trusted on the system because they will not use this CA.

> Any explanation of this/way to fix it?

If the application is built to only trust a single certificate/public key and never trust something just because it is signed by a locally trusted CA, then you would need the original certificate and its private key to do the SSL interception. Since you don't have these there is no way to do the SSL interception.

Attributions

All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionGrant BrownView Question on Stackoverflow
Solution 1 - IosNeil SarkarView Answer on Stackoverflow
Solution 2 - IosSteffen UllrichView Answer on Stackoverflow