This is a migrated thread and some comments may be shown as answers.

Android app not allowing me to connect when 'Decrypt HTTPS Traffic' is enabled

6 Answers 992 Views
Mobile
This is a migrated thread and some comments may be shown as answers.
Mahdi
Top achievements
Rank 1
Mahdi asked on 09 Jul 2020, 05:45 PM

I have a certain Android app that's not publicly available so you won't be able to fully troubleshoot, however I can explain the behavior I'm experiencing. 
When I attempt to use the app when  'Decrypt HTTPS Traffic' is disabled, the app works, but the data is encrypted and Fiddler prompts me to configure the settings.
When I enable 'Decrypt HTTPS Traffic' the app does not let me do anything and simply says 'network unavailable.' 
I did install the Android certificate. I tested on several other apps and don't appear to be experiencing the same problem. Any ideas on how I can further troubleshoot this?

the application url is here:

https://c.quizofkings.com/apks/QuizOfKingss-secure-direct-direct-6146.apk

 

6 Answers, 1 is accepted

Sort by
0
Eric R | Senior Technical Support Engineer
Telerik team
answered on 09 Jul 2020, 08:04 PM

Hi Mahdi,

This is most likely a security measure implemented by the App Developer. Something like, Certificate Pinning will not work with Fiddler certificates. 

Additionally, apps targeting API Level 24 will ignore all user-installed root certificates which may be causing the issue.

Lastly, can you confirm that you followed the steps as outlined in the How to: Capture Android Traffic with Fiddler blog post?

Please let me know if you need any additional information. Thank you for using the Fiddler forums.

Regards,


Eric R | Senior Technical Support Engineer
Progress Telerik

Progress is here for your business, like always. Read more about the measures we are taking to ensure business continuity and help fight the COVID-19 pandemic.
Our thoughts here at Progress are with those affected by the outbreak.
0
Herb
Top achievements
Rank 1
Iron
answered on 18 Aug 2020, 04:28 PM
Eric,  Is there anyway around this or are there alternative solutions for these trouble cases?  I have been a big fan of Fiddler for several years and it works great in so many situations.  However, every year or so, I run into a similar issue.  I check the forums, google for answers, attempt fixes, and then struggle with it until the problem reoccurs the next year.  It would be great to find something that could handle these problem situations.
0
Herb
Top achievements
Rank 1
Iron
answered on 18 Aug 2020, 04:32 PM
Also, I keep thinking another proxy package might work better.  I end up wasting lot's of time installing and debugging other packages, and in the end, nothing else works nearly as well as Fiddler.
0
Eric R | Senior Technical Support Engineer
Telerik team
answered on 18 Aug 2020, 09:07 PM

Hi Herb,

Thank you for the kind words regarding Fiddler. However, since the Decrypt HTTPS issues are platform specific, there isn't anything Fiddler can do to alleviate them.

Ultimately, the goal of Fiddler is to aide in debugging applications and it works best when the source code is available. 

For other scenarios, low-level network analyzer tools like WireShark might make more sense. 

I hope this helps. Please let me know if you need any additional information. Thank you.

Regards,


Eric R | Senior Technical Support Engineer
Progress Telerik

0
Herb
Top achievements
Rank 1
Iron
answered on 06 Jan 2021, 03:28 PM
 

Eric,

Are there any new thoughts here?  It seems like the Android API level 24 thing would be a show stopper.  However, I am successfully able to decode certain apps, which also tells me my certificates are good.  On the other hand, other apps are not working, even though the same use-case may have worked for me a month ago.  Very strange...

 

 
0
Eric R | Senior Technical Support Engineer
Telerik team
answered on 06 Jan 2021, 03:42 PM

Hi Herb,

If the apps are developed by you it is possible to temporarily override the API Level 24 issue by changing the application configuration as described in the Eric Law's Using Fiddler with iOS 10 and Android 7 blog post.

If the apps are not developed by you, then there isn't a way to make this change unless the developer wants to do it. This unlikely, as it is a security feature for the Android Platform and there is no way for Fiddler to circumvent it.

Please let me know if you need any additional information. Thank you.

Regards,


Eric R | Senior Technical Support Engineer
Progress Telerik

Virtual Classroom, the free self-paced technical training that gets you up to speed with Telerik and Kendo UI products quickly just got a fresh new look + new and improved content including a brand new Blazor course! Check it out at https://learn.telerik.com/.

Tags
Mobile
Asked by
Mahdi
Top achievements
Rank 1
Answers by
Eric R | Senior Technical Support Engineer
Telerik team
Herb
Top achievements
Rank 1
Iron
Share this question
or