This is a migrated thread and some comments may be shown as answers.

Cloudflare's oauth detects wrong certificate

2 Answers 1216 Views

Windows

This is a migrated thread and some comments may be shown as answers.

Lars-Daniel asked on 25 Apr 2020, 05:35 PM

I'm using Fiddler to analyze an Android app. It communicates with the server through HTTPS, Fiddler has no problems to decrypt the traffc when using its root certificate.But the authentification of the app works using OAuth on a Cloudflare server and it seems to detect Fiddler's root certificate (the MITM).

I need to deactivate Capture HTTPS CONNECTs to make it work - it's not enough to deactivate Decrypt HTTPS traffic.

I wrote a small FiddlerScript, but it also doesn't work, since it deactives the decrypting only, not the capturing. Is there a hack for this?

1.if (oSession.uriContains("/oauth/") || oSession.uriContains("/bd/")) {

2. oSession["x-no-decrypt"] = "do not care.";

3. oSession["ui-color"] = "red";

4.}

This only occures on some Android apps. Sometime seem to have a weaker setting in Cloudflare and let the Fiddler root certificate pass through.

2 Answers, 1 is accepted

answered on 29 Apr 2020, 01:38 PM

Hi Lars-Daniel,

Unfortunately, there isn't a hack for this because the remote website has implemented a security measure blocking untrusted certificates. See the Understanding CONNECT Tunnels article for more information.

Also, no problem on the title. Let me know the title that you would like to use and I can change it.

In the meantime, please let me know if you need any additional information. Thank you for using the Fiddler Forums.

Regards,

Eric R | Senior Technical Support Engineer
Progress Telerik

Progress is here for your business, like always. Read more about the measures we are taking to ensure business continuity and help fight the COVID-19 pandemic.
Our thoughts here at Progress are with those affected by the outbreak.