How can I use BurpSuite proxy with HTTPS in chrome

google-chrome ssl proxy burp
Silver picture Silver · Dec 5, 2015 · Viewed 36.2k times · Source

BurpSuite can only intercept HTTP traffic. How can I also intercept HTTPS traffic on Ubuntu? I need to install the CA but how?

Answer

Silver picture Silver · Dec 5, 2015

Obtaining the certificate:

  • When chrome is configured to use Burp as a proxy, go to http://burp/cert and the DER encoded certificate will be downloaded automatically.
  • Download the certificate in BurpSuite under the Proxy->Options tab under Import / export CA certificate. Export the certificate in DER format.

Install the certificate:

  • Either by double clicking on it in your file browser (Nautilus in my case) or by importing it into Chrome.
    1. Another way of installing it is by importing directly into Chrome. Go to settings->Show advance settings... (at the bottom)->HTTPS/SSL:Manage certificates->Authorities(tab)->Import
    2. In the file selector you must set the file filter to 'DER-encoded binary..' or 'all files' to make your certificate file visible. The default file selector setting is base-64 encoded ASCII and our file is DER encoded.

Now, for the step I was missing in other explanations, in the chrome certificate manager in the tab Authorities (where you just imported the certificate), find the newly imported certificate. In my case it looked like this: enter image description here

Notice the "Untrusted", in my case this meant that it I still got the SSL warnings and the red padlock. Click on "untrusted PortSwigger CA" and click Edit...

Check "Trust this certificate for identifying websites." and click "OK". In my case the text "untrusted" didn't disappear directly but after restarting Chrome, the PortSwigger CA was trusted and SSL proxying works.

If this is a duplicate please tell me, but I haven't found a similar explanation.

Related questions

Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More
SSL certificate is not trusted - on mobile only

My site is working great over SSL in my desktops (chrome) I have a green lock near the address bar saying "Identity verified" But using a mobile mobile browser (Chrome/Safari)I see the following message - "The identity of …

Read More
Invalid self signed SSL cert - "Subject Alternative Name Missing"

Recently, Chrome has stopped working with my self signed SSL certs, and thinks they're insecure. When I look at the cert in the DevTools | Security tab, I can see that it says Subject Alternative Name Missing The certificate for this …

Read More