Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Certificate pinning for apps on macOS

Faiz | Last updated: Feb 27, 2021 06:44PM UTC

Hello! Is there any way to intercept requests from apps running on macOS(Big Sur) that also have certificate pinning. The app I am testing is not proxy aware but I still managed to run using environment variables - env https_proxy=https://127.0.0.1 <path to application> On Burp Suite I see the following error - "The client failed to negotiate a TLS connection: Remote host terminated the handshake". In the app logs, one of the error message is "reason: self signed certificate" I am aware of the Mobile Assistant. My requirement is for app on macOS. I am running Big Sur. I would really appreciate any assistance.

Michelle, PortSwigger Agent | Last updated: Mar 02, 2021 08:48AM UTC

Thanks for your message. Issues with certificate pinning are non-trivial and very much depend on the details of how it is done. It's not automatic that you can bypass certificate pinning for self-signed certificates, since the pinning might validate the public key of the certificate, and you'll need the original private key to use the certificate.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.