[GH-ISSUE #1370] SSL Handshake Failed #1365

Closed
opened 2026-03-03 19:50:51 +03:00 by kerem · 10 comments
Owner

Originally created by @ghost on GitHub (Sep 25, 2022).
Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1370

Description

SSL decryption failed

handshakeFailed(NIOSSL.BoringSSLError.sslError([Error: 268436502 error:10000416:SSL routines:OPENSSL_internal:SSLV3_ALERT_CERTIFICATE_UNKNOWN]))

Steps to Reproduce

1.Install the Proxyman Certificate on Your iOS Device
2.Enable SSL kill switch
3.Launch the app and enable decryption
4.fail to decrypt

Current Behavior

Unable to decrypt SSL
Therefore, you cannot view the contents of the communication.

Expected Behavior

Decrypt SSL successfully to view data

Environment

  • App version: e.g Proxyman 3.10.0
  • macOS version: e.g macOS Monterey
Originally created by @ghost on GitHub (Sep 25, 2022). Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1370 ## Description <!--- Description for the bug? --> SSL decryption failed ``` handshakeFailed(NIOSSL.BoringSSLError.sslError([Error: 268436502 error:10000416:SSL routines:OPENSSL_internal:SSLV3_ALERT_CERTIFICATE_UNKNOWN])) ``` ## Steps to Reproduce <!-- Add relevant code and/or a live example --> 1.Install the Proxyman Certificate on Your iOS Device 2.Enable SSL kill switch 3.Launch the app and enable decryption 4.fail to decrypt ## Current Behavior <!--- What went wrong? --> Unable to decrypt SSL Therefore, you cannot view the contents of the communication. ## Expected Behavior <!--- What should have happened? --> Decrypt SSL successfully to view data ## Environment - App version: e.g Proxyman 3.10.0 - macOS version: e.g macOS Monterey
kerem 2026-03-03 19:50:51 +03:00
  • closed this issue
  • added the
    bug
    label
Author
Owner

@NghiaTranUIT commented on GitHub (Sep 26, 2022):

Does it seem that SSL Kill Switch doesn't work? 🤔 @KohnoseLami

SSL Handshake failed because the app, which supports SSL Pinning, rejected Proxyman CA Certificate. You use SSL Kill Switch to bypass it, but I'm not sure if you properly config it.

<!-- gh-comment-id:1257401265 --> @NghiaTranUIT commented on GitHub (Sep 26, 2022): Does it seem that SSL Kill Switch doesn't work? 🤔 @KohnoseLami SSL Handshake failed because the app, which supports SSL Pinning, rejected Proxyman CA Certificate. You use SSL Kill Switch to bypass it, but I'm not sure if you properly config it.
Author
Owner

@ghost commented on GitHub (Sep 26, 2022):

I tested it under the following three conditions.

  1. The Proxyman certificate has not been installed (The SSL kill switch is also turned off.).
  2. The Proxyman certificate is installed (The SSL kill switch is off.).
  3. The Proxyman certificate is installed (The SSL kill switch is also on.).

The same error was output under all conditions.
Is this due to SSL Pinning rather than Proxyman certificate error?
When I tried it with the same application in the past, it worked once, but it didn't work when I tried it again.
If you drop the version of the application, it won't change.

<!-- gh-comment-id:1258159164 --> @ghost commented on GitHub (Sep 26, 2022): I tested it under the following three conditions. 1. The Proxyman certificate has not been installed (The SSL kill switch is also turned off.). 2. The Proxyman certificate is installed (The SSL kill switch is off.). 3. The Proxyman certificate is installed (The SSL kill switch is also on.). The same error was output under all conditions. Is this due to SSL Pinning rather than Proxyman certificate error? When I tried it with the same application in the past, it worked once, but it didn't work when I tried it again. If you drop the version of the application, it won't change.
Author
Owner

@NghiaTranUIT commented on GitHub (Sep 26, 2022):

  1. The Proxyman certificate has not been installed (The SSL kill switch is also turned off.).

100% gets SSL Error because the certificate is not installed.

  1. The Proxyman certificate is installed (The SSL kill switch is off.).

Which app are you trying to intercept? If it's a well-known app, such as Facebook, or Instagram, ... it's SSL Pinning.

  1. The Proxyman certificate is installed (The SSL kill switch is also on.).

Not sure if the SSL Kill Switch Config is correct. If it's not right, the SSL Error can occur.

<!-- gh-comment-id:1258162290 --> @NghiaTranUIT commented on GitHub (Sep 26, 2022): > 1. The Proxyman certificate has not been installed (The SSL kill switch is also turned off.). 100% gets SSL Error because the certificate is not installed. > 2. The Proxyman certificate is installed (The SSL kill switch is off.). Which app are you trying to intercept? If it's a well-known app, such as Facebook, or Instagram, ... it's SSL Pinning. > 3. The Proxyman certificate is installed (The SSL kill switch is also on.). Not sure if the SSL Kill Switch Config is correct. If it's not right, the SSL Error can occur.
Author
Owner

@ghost commented on GitHub (Sep 26, 2022):

The app is called CapCut. This is an app made by Bytedance, a TikTok company, so there is a possibility that SSL Pinning exists.
However, since what I want is WebSocket, there is very little information on these.

<!-- gh-comment-id:1258176761 --> @ghost commented on GitHub (Sep 26, 2022): The app is called CapCut. This is an app made by Bytedance, a TikTok company, so there is a possibility that SSL Pinning exists. However, since what I want is WebSocket, there is very little information on these.
Author
Owner

@maximebories commented on GitHub (Sep 28, 2022):

It happens, and I'd say there is a 99% probability that this is because of a SSL pinning mechanism.

Now if you really want to be sure (but is it worth it ?), you could install the Frida.re framework and after digging a little you will find a SLL pinning library or retrieve a debug log which would confirm that. I haven't used it for ages but from memory it also allowed few people to bypass some SSL pinning mechanisms. Frida is easy to install on Android or a jailbroken iPhone, it's feasible but way more annoying on a non-rooted iPhone.

I don't know what your end goal is here, but I saw there is a web version of the app, maybe it's worth investigating...

Good luck

<!-- gh-comment-id:1260362675 --> @maximebories commented on GitHub (Sep 28, 2022): It happens, and I'd say there is a 99% probability that this is because of a SSL pinning mechanism. Now if you really want to be sure (but is it worth it ?), you could install the Frida.re framework and after digging a little you will find a SLL pinning library or retrieve a debug log which would confirm that. I haven't used it for ages but from memory it also allowed few people to bypass some SSL pinning mechanisms. Frida is easy to install on Android or a jailbroken iPhone, it's feasible but way more annoying on a non-rooted iPhone. I don't know what your end goal is here, but I saw there is a web version of the app, maybe it's worth investigating... Good luck
Author
Owner

@chhpt commented on GitHub (Sep 28, 2022):

I've had some similar situations (with certificates installed and SSL Pinning turned off) where some domains would report an error and others would not, and after restarting Proxyman or the App it might be back to normal again

<!-- gh-comment-id:1260592946 --> @chhpt commented on GitHub (Sep 28, 2022): I've had some similar situations (with certificates installed and SSL Pinning turned off) where some domains would report an error and others would not, and after restarting Proxyman or the App it might be back to normal again
Author
Owner

@NghiaTranUIT commented on GitHub (Sep 28, 2022):

I've had some similar situations (with certificates installed and SSL Pinning turned off) where some domains would report an error and others would not, and after restarting Proxyman or the App it might be back to normal again

Can you provide some information? Is it an iOS/Android app? Native, ReactNative, Flutter 🤔

<!-- gh-comment-id:1260594456 --> @NghiaTranUIT commented on GitHub (Sep 28, 2022): > I've had some similar situations (with certificates installed and SSL Pinning turned off) where some domains would report an error and others would not, and after restarting Proxyman or the App it might be back to normal again Can you provide some information? Is it an iOS/Android app? Native, ReactNative, Flutter 🤔
Author
Owner

@ghost commented on GitHub (Sep 28, 2022):

It happens, and I'd say there is a 99% probability that this is because of a SSL pinning mechanism.

Now if you really want to be sure (but is it worth it ?), you could install the Frida.re framework and after digging a little you will find a SLL pinning library or retrieve a debug log which would confirm that. I haven't used it for ages but from memory it also allowed few people to bypass some SSL pinning mechanisms. Frida is easy to install on Android or a jailbroken iPhone, it's feasible but way more annoying on a non-rooted iPhone.

I don't know what your end goal is here, but I saw there is a web version of the app, maybe it's worth investigating...

Good luck

I used Frida once, but it was very difficult and difficult.
For this reason, I used the SSL kill switch, but many applications do not work correctly.

I didn't know that there was a desktop app, that there was a web version.
My research is insufficient.
That information is likely to help me a lot. Thank you!

<!-- gh-comment-id:1260607175 --> @ghost commented on GitHub (Sep 28, 2022): > It happens, and I'd say there is a 99% probability that this is because of a SSL pinning mechanism. > > Now if you really want to be sure (but is it worth it ?), you could install the Frida.re framework and after digging a little you will find a SLL pinning library or retrieve a debug log which would confirm that. I haven't used it for ages but from memory it also allowed few people to bypass some SSL pinning mechanisms. Frida is easy to install on Android or a jailbroken iPhone, it's feasible but way more annoying on a non-rooted iPhone. > > I don't know what your end goal is here, but I saw there is a web version of the app, maybe it's worth investigating... > > Good luck I used Frida once, but it was very difficult and difficult. For this reason, I used the SSL kill switch, but many applications do not work correctly. I didn't know that there was a desktop app, that there was a web version. My research is insufficient. That information is likely to help me a lot. Thank you!
Author
Owner

@ghost commented on GitHub (Sep 28, 2022):

I've had some similar situations (with certificates installed and SSL Pinning turned off) where some domains would report an error and others would not, and after restarting Proxyman or the App it might be back to normal again

The same thing happened to me in CapCut.
Therefore, we are currently experimenting based on the communication captured in the past.
However, because of the missing information, I need to capture it again, but I am already in a situation where I cannot do it.

<!-- gh-comment-id:1260610734 --> @ghost commented on GitHub (Sep 28, 2022): > I've had some similar situations (with certificates installed and SSL Pinning turned off) where some domains would report an error and others would not, and after restarting Proxyman or the App it might be back to normal again The same thing happened to me in CapCut. Therefore, we are currently experimenting based on the communication captured in the past. However, because of the missing information, I need to capture it again, but I am already in a situation where I cannot do it.
Author
Owner

@ghost commented on GitHub (Sep 28, 2022):

It happens, and I'd say there is a 99% probability that this is because of a SSL pinning mechanism.

Now if you really want to be sure (but is it worth it ?), you could install the Frida.re framework and after digging a little you will find a SLL pinning library or retrieve a debug log which would confirm that. I haven't used it for ages but from memory it also allowed few people to bypass some SSL pinning mechanisms. Frida is easy to install on Android or a jailbroken iPhone, it's feasible but way more annoying on a non-rooted iPhone.

I don't know what your end goal is here, but I saw there is a web version of the app, maybe it's worth investigating...

Good luck

When I checked the Web version, the required functions were reduced, so when I installed the Windows software, I found the required functions, so I connected the whole Windows through Proxyman and installed the certificate, and I was able to capture the Websocket successfully.

Now that I've solved my problem, I'm going to quote and close this post.
Thank you!

<!-- gh-comment-id:1260750550 --> @ghost commented on GitHub (Sep 28, 2022): > It happens, and I'd say there is a 99% probability that this is because of a SSL pinning mechanism. > > Now if you really want to be sure (but is it worth it ?), you could install the Frida.re framework and after digging a little you will find a SLL pinning library or retrieve a debug log which would confirm that. I haven't used it for ages but from memory it also allowed few people to bypass some SSL pinning mechanisms. Frida is easy to install on Android or a jailbroken iPhone, it's feasible but way more annoying on a non-rooted iPhone. > > I don't know what your end goal is here, but I saw there is a web version of the app, maybe it's worth investigating... > > Good luck When I checked the Web version, the required functions were reduced, so when I installed the Windows software, I found the required functions, so I connected the whole Windows through Proxyman and installed the certificate, and I was able to capture the Websocket successfully. Now that I've solved my problem, I'm going to quote and close this post. Thank you!
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Proxyman#1365
No description provided.