• caglararli@hotmail.com
  • 05386281520

Android Root Certificate Issue

Çağlar Arlı      -    13 Views

Android Root Certificate Issue

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But issue arise when I've changed my ZAP certificate in ZAP Proxy. So with the new certificate on ZAP Proxy, the normal way to do was to install the certificate into my Android phone. But with an existing ZAP certificate in place, I can't do that.

If I attempt to remove the old ZAP certificate from /system/etc/security/cacerts , reboot, install the new certificate and reboot again, the certificate will not be shown inside the credential storage.

Moving on, I've tried to remove the new certificate and place the old certificate back and reboot, the certificate will now appear in the credential storage.

Why would I not choose to just import the old certificate into the new ZAP proxy? Because importing certificate into ZAP requires the format of both the certificate and unencrypted private key. (https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsDynsslcert)

I've actually encountered this issue not only with ZAP certificate but also with Burp certificate, trying to install a new certificate with the same name does not work. If anyone has any solution, please do help me.

For references: This is my steps inserting custom certificate into Android phone. (https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)