starred/Proxyman

Fork 0

mirror of https://github.com/ProxymanApp/Proxyman.git synced 2026-04-25 16:15:55 +03:00

[GH-ISSUE #229] kCFStreamErrorDomainSSL error -9806 #224

New issue

Closed

opened 2026-03-03 19:16:23 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 19:16:23 +03:00

Owner

Originally created by @tuckerconnelly on GitHub (Jul 26, 2019).
Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/229

Proxyman version? (Ex. Proxyman 1.4.3)

1.4.6

macOS Version? (Ex. mac 10.14)

10.14.3

Steps to reproduce

Set up iOS proxy and try to inspect requests from UberEats app

Expected behavior

Be able to see the JSON

Screenshots (optional)

Originally created by @tuckerconnelly on GitHub (Jul 26, 2019). Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/229 ### Proxyman version? (Ex. Proxyman 1.4.3) 1.4.6 ### macOS Version? (Ex. mac 10.14) 10.14.3 ### Steps to reproduce Set up iOS proxy and try to inspect requests from UberEats app ### Expected behavior Be able to see the JSON ### Screenshots (optional) <img width="1218" alt="Screen Shot 2019-07-25 at 6 21 36 PM" src="https://user-images.githubusercontent.com/4349082/61919135-1269c980-af09-11e9-8812-2e9878c8efea.png">

kerem

2026-03-03 19:16:23 +03:00

closed this issue
added the
✅ Done
label

kerem commented

2026-03-03 19:16:24 +03:00

Author

Owner

@tuckerconnelly commented on GitHub (Jul 26, 2019):

Looks like there are a few potential solutions in here: https://stackoverflow.com/questions/30791361/nsurlsession-http-load-failed-kcfstreamerrordomainssl-9813-self-signing-cer

@tuckerconnelly commented on GitHub (Jul 26, 2019): Looks like there are a few potential solutions in here: https://stackoverflow.com/questions/30791361/nsurlsession-http-load-failed-kcfstreamerrordomainssl-9813-self-signing-cer

kerem commented

2026-03-03 19:16:24 +03:00

Author

Owner

@NghiaTranUIT commented on GitHub (Jul 26, 2019):

Hey @tuckerconnelly, the reason why Proxyman couldn't see the content of Uber's APIs because it's protected by SSL-Pining mechanism, which is deliberately designed to prevent MitM apps like Proxyman, Fiddler, ...

Technically, UberEat only trusts all requests, which are signed by their own certificate. So Proxyman's Certificate doesn't fulfill them => Error 9806.

Your suggestion only works with iOS app, since it's sandbox and one of security requirements, but it's not for Proxyman (not sandbox app), and the problem is different 😄

Here some apps I know so far that support SSL-pining:

Well-known app: Facebook, Uber, Grab, Twitter, ...
Google Analytic on mobile: e.crashlytics.com
Banking and e-commerce apps too.

Let me know if you need further help 👍

P/S: If you're developer at UberEat, you can manually disable the SSL-Pining or trust Proxyman CA in DEV build.

@NghiaTranUIT commented on GitHub (Jul 26, 2019): Hey @tuckerconnelly, the reason why Proxyman couldn't see the content of Uber's APIs because it's protected by SSL-Pining mechanism, which is **deliberately** designed to prevent MitM apps like Proxyman, Fiddler, ... Technically, UberEat only trusts all requests, which are signed by their own certificate. So Proxyman's Certificate doesn't fulfill them => Error 9806. Your suggestion only works with iOS app, since it's sandbox and one of security requirements, but it's not for Proxyman (not sandbox app), and the problem is different 😄 Here some apps I know so far that support SSL-pining: 1. Well-known app: Facebook, Uber, Grab, Twitter, ... 2. Google Analytic on mobile: `e.crashlytics.com` 3. Banking and e-commerce apps too. Let me know if you need further help 👍 P/S: If you're developer at UberEat, you can manually disable the SSL-Pining or trust Proxyman CA in DEV build.

kerem commented

2026-03-03 19:16:24 +03:00

Author

Owner

@tuckerconnelly commented on GitHub (Jul 29, 2019):

Hey @NghiaTranUIT just want to thank you for the super thorough response. If I could tip you a few (or sponsor this project on GitHub) I would. I'd buy Proxyman, but the utility of it is limited for my use case given the SSL pinning defense. Good luck, your hard work is inspiring :)

@tuckerconnelly commented on GitHub (Jul 29, 2019): Hey @NghiaTranUIT just want to thank you for the super thorough response. If I could tip you a few $$ (or sponsor this project on GitHub) I would. I'd buy Proxyman, but the utility of it is limited for my use case given the SSL pinning defense. Good luck, your hard work is inspiring :)

kerem commented

2026-03-03 19:16:24 +03:00

Author

Owner

@NghiaTranUIT commented on GitHub (Jul 30, 2019):

Hey, Thank for kind words. Don't worry about the , if you like Proxyman, you can spread it out to your friends or workmates or tweet 🐦and tags us @proxyman_app. The best sponsor is word of mouth 😄

Thank you so much 🎉

@NghiaTranUIT commented on GitHub (Jul 30, 2019): Hey, Thank for kind words. Don't worry about the $$, if you like Proxyman, you can spread it out to your friends or workmates or tweet 🐦and tags us `@proxyman_app`. The best sponsor is word of mouth 😄 Thank you so much 🎉