Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Auto-reject client requests for sites with bad certificates

Greg | Last updated: Jun 29, 2017 03:28AM UTC

I'd like to configure Burp Suite to automatically reject requests from the client for sites with bad certificates. This seems really basic, but I haven't found a way to do this. Using badssl.com for testing, Burp Suite lets all of the bad certs right through. Thank you in advance for your help.

PortSwigger Agent | Last updated: Jun 29, 2017 07:12AM UTC

This isn't possible at present. Most pen testers will do a separate phase of testing to investigate the server's SSL certificate and configuration, using a tool like testssl. We do have this on our backlog. We are planning to refactor the networking and SSL code at some point, and we'll incorporate this feature when we do. Rather than reject the request, what we'll probably do is generate a deliberately invalid certificate to return to the browser, so the errors are passed through. Please let us know if you need any further assistance.

Ben, PortSwigger Agent | Last updated: Jun 21, 2022 10:20AM UTC