[GH-ISSUE #1007] SSL proxying does not work for connections to apple.com #1002

Open
opened 2026-03-03 19:23:40 +03:00 by kerem · 9 comments
Owner

Originally created by @vprelovac on GitHub (Sep 25, 2021).
Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1007

Originally assigned to: @NghiaTranUIT on GitHub.

Proxyman version? (Ex. Proxyman 1.4.3)

Latest

macOS Version? (Ex. mac 10.14)

11.5

Steps to reproduce

Turn on SSL proxying for apple.com

Expected behavior

apple.com loads

Instead it fails to load with:

SSL Handshake Failed
handshakeFailed(NIOSSL.BoringSSLError.sslError([]))

Screenshots (optional)

Screen 2021-09-25 at 13 00 37@2x

Screen 2021-09-25 at 12 58 58@2x

Proxyman cert is installed and trusted.

Originally created by @vprelovac on GitHub (Sep 25, 2021). Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1007 Originally assigned to: @NghiaTranUIT on GitHub. ### Proxyman version? (Ex. Proxyman 1.4.3) Latest ### macOS Version? (Ex. mac 10.14) 11.5 ### Steps to reproduce Turn on SSL proxying for apple.com ### Expected behavior apple.com loads Instead it fails to load with: SSL Handshake Failed handshakeFailed(NIOSSL.BoringSSLError.sslError([])) ### Screenshots (optional) ![Screen 2021-09-25 at 13 00 37@2x](https://user-images.githubusercontent.com/4319401/134784641-66faf249-936b-4bcc-99ac-34e74f1662ef.jpg) ![Screen 2021-09-25 at 12 58 58@2x](https://user-images.githubusercontent.com/4319401/134784607-324ccfa5-9f3f-481c-90f6-ccd0668b5cb4.jpg) Proxyman cert is installed and trusted.
Author
Owner

@NghiaTranUIT commented on GitHub (Sep 26, 2021):

Hey, this issue happens with Charles Proxy and Fiddler too. For some reason, Safari rejects all SSL from self-signed certificates and there is no way to fix it.

If you try to sniff apple.com from Google Chrome, it works fine without any problems 👍

I suppose that it's an intention from Apple to prevent being intercepted from Mitm apps.

<!-- gh-comment-id:927209929 --> @NghiaTranUIT commented on GitHub (Sep 26, 2021): Hey, this issue happens with Charles Proxy and Fiddler too. For some reason, Safari rejects all SSL from self-signed certificates and there is no way to fix it. If you try to sniff apple.com from Google Chrome, it works fine without any problems 👍 I suppose that it's an intention from Apple to prevent being intercepted from Mitm apps.
Author
Owner

@vprelovac commented on GitHub (Sep 26, 2021):

Thank you for your comment. I am interested in the origin of the touch icon for apple.com that Safari uses and clearly downloads from apple.com.

Screen 2021-09-26 at 08 33 10@2x

However it is not https://apple.com/apple-touch-icon.png

Laying it out there in case you had other ideas how to get it.

<!-- gh-comment-id:927325056 --> @vprelovac commented on GitHub (Sep 26, 2021): Thank you for your comment. I am interested in the origin of the touch icon for apple.com that Safari uses and clearly downloads from apple.com. ![Screen 2021-09-26 at 08 33 10@2x](https://user-images.githubusercontent.com/4319401/134814377-a56d16a5-52f5-42d7-8216-1a22fa250bae.jpg) However it is not https://apple.com/apple-touch-icon.png Laying it out there in case you had other ideas how to get it.
Author
Owner

@NghiaTranUIT commented on GitHub (Sep 27, 2021):

I'm not sure how to find the touch icon you'd like. Maybe we can get from the Developer Inspector or parse the <head> of apple website 🤔

<!-- gh-comment-id:927543565 --> @NghiaTranUIT commented on GitHub (Sep 27, 2021): I'm not sure how to find the touch icon you'd like. Maybe we can get from the Developer Inspector or parse the <head> of apple website 🤔
Author
Owner

@vprelovac commented on GitHub (Sep 27, 2021):

Apple seems to use a non-standard file name for it and SSL proxy was my only hope. As you said none of the others work too and I tried them all. Thanks for looking into it anyway.

<!-- gh-comment-id:927886008 --> @vprelovac commented on GitHub (Sep 27, 2021): Apple seems to use a non-standard file name for it and SSL proxy was my only hope. As you said none of the others work too and I tried them all. Thanks for looking into it anyway.
Author
Owner

@VaslD commented on GitHub (Nov 19, 2021):

https://www.apple.com/apple-touch-icon.png

The file apple-touch-icon.png in the root/home directory of the website is used unless a link is specified in the <head> element of the web page:

<link rel="apple-touch-icon" href="/icons/from/somewhere-else.png"/>

This isn't RFC'd but is pretty much universal on all major websites. Like https://facebook.com/apple-touch-icon.png

Edit: Found documentation: https://developer.apple.com/library/archive/documentation/AppleApplications/Reference/SafariWebContent/ConfiguringWebApplications/ConfiguringWebApplications.html

<!-- gh-comment-id:974162592 --> @VaslD commented on GitHub (Nov 19, 2021): https://www.apple.com/apple-touch-icon.png The file `apple-touch-icon.png` in the root/home directory of the website is used unless a link is specified in the `<head>` element of the web page: ``` <link rel="apple-touch-icon" href="/icons/from/somewhere-else.png"/> ``` This isn't RFC'd but is pretty much universal on all major websites. Like https://facebook.com/apple-touch-icon.png Edit: Found documentation: https://developer.apple.com/library/archive/documentation/AppleApplications/Reference/SafariWebContent/ConfiguringWebApplications/ConfiguringWebApplications.html
Author
Owner

@chrise86 commented on GitHub (Dec 17, 2021):

For some reason I can't even see requests made to itunes.apple.com, yet can see other apple related calls.

<!-- gh-comment-id:996861693 --> @chrise86 commented on GitHub (Dec 17, 2021): For some reason I can't even _see_ requests made to `itunes.apple.com`, yet can see other apple related calls.
Author
Owner

@NghiaTranUIT commented on GitHub (Dec 19, 2021):

There are many reasons why you might not see the itunes.apple.com. One of the reasons is that this traffic doesn't go through the System HTTP/HTTPS Proxy, where Proxyman is listening. It might intentionally be designed this way to prevent being captured from the MitM app.

Even though we can capture itunes.apple.com, but you couldn't intercept their HTTPS Traffic, because it's protected by SSL Pinning.

<!-- gh-comment-id:997325207 --> @NghiaTranUIT commented on GitHub (Dec 19, 2021): There are many reasons why you might not see the `itunes.apple.com`. One of the reasons is that this traffic doesn't go through the System HTTP/HTTPS Proxy, where Proxyman is listening. It might intentionally be designed this way to prevent being captured from the MitM app. Even though we can capture `itunes.apple.com`, but you couldn't intercept their HTTPS Traffic, because it's protected by SSL Pinning.
Author
Owner

@chrise86 commented on GitHub (Dec 19, 2021):

There are many reasons why you might not see the itunes.apple.com. One of the reasons is that this traffic doesn't go through the System HTTP/HTTPS Proxy, where Proxyman is listening. It might intentionally be designed this way to prevent being captured from the MitM app.

Even though we can capture itunes.apple.com, but you couldn't intercept their HTTPS Traffic, because it's protected by SSL Pinning.

The request is inside a react native app. Although, I’ve noticed Proxyman randomly not showing some requests sometimes, but showing them randomly at other times, so I’m not sure what it is currently.

<!-- gh-comment-id:997439869 --> @chrise86 commented on GitHub (Dec 19, 2021): > There are many reasons why you might not see the `itunes.apple.com`. One of the reasons is that this traffic doesn't go through the System HTTP/HTTPS Proxy, where Proxyman is listening. It might intentionally be designed this way to prevent being captured from the MitM app. > > Even though we can capture `itunes.apple.com`, but you couldn't intercept their HTTPS Traffic, because it's protected by SSL Pinning. The request is inside a react native app. Although, I’ve noticed Proxyman randomly not showing some requests sometimes, but showing them randomly at other times, so I’m not sure what it is currently.
Author
Owner

@NghiaTranUIT commented on GitHub (Dec 20, 2021):

Can you share with me what the App is? I'd like to download and test it.

As it's a React native app, so it might not respect the HTTP System Proxy too. Doc: https://docs.proxyman.io/debug-devices/react-native

<!-- gh-comment-id:997524870 --> @NghiaTranUIT commented on GitHub (Dec 20, 2021): Can you share with me what the App is? I'd like to download and test it. As it's a React native app, so it might not respect the HTTP System Proxy too. Doc: https://docs.proxyman.io/debug-devices/react-native
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Proxyman#1002
No description provided.