How do make Fiddler HTTPS Decryption work with resilient apps?

1
votes

Fiddler works perfectly to decrypt HTTPS request on many apps and browsers, but there's only single app that simply refuses to work when Fiddler is ON and works normally when Fiddler is OFF.

I've heard that it is because some apps do "Certificate Pinning", which means they "use a special certificate and will not work with Fiddler root cert" (Paraphrasing this).

When I open the app in question, I get this message in Fiddler enter image description here

If I say yes, a few of the app's request will get in, but soon after the app will stop working as if there was no internet connection.

1
fiddlerhttp-proxy

1 Answers

1
votes

This warning has nothing to do with certificate pinning.

Usually SSL/TLS works this way that you buy or get a certificate for your server from one of the world wide certificate authorities that a trusted by the common platforms/OS. Excluding the Let's Encrypt CA getting a certificate usually costs money.

For web sites this is is a required step as you can't control which web browser on which OS the people use that visit your site.

However if there is only your application that uses your server some developers skip the step to get a certificate from a common certificate authority (CA). That saves the money they would have to spend to the CA. Instead they use a self-signed certificate on the server and include the public certificate into the application (and mark it as trusted in the application).

When using a self-signed certificate this can also be used for performing certificate- or root-CA pinning. However this step is optionally and is not automatically true for applications which use servers with self-signed certificates.

The dialog shown in the question indicates that the application uses a server that uses a self-signed certificate (or at least a certificate signed by an unknown hence untrusted CA).

The strange part is that the server seem to be running on 127.0.0.1 (localhost). Hence it looks like the application uses HTTPS for communication between multiple processes that are running on your system.

If you are not interested in the traffic of this application I would recommend to you to exclude localhost (127.0.0.1) traffic in Fiddler HTTPS decryption:

enter image description here

Afterwards the application should work again.