Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

not supporting HSTS

navdeep | Last updated: Jul 14, 2016 09:59AM UTC

i am trying hard to access sites with hsts enabled via burp proxy. did installed the firefox older version 3.6.25 but not working properly . nothing is displayed on screen keep on saying wrong certificate . i am facing this prob. will all browser and with older and new versions of burp suite. where as similar setting is working fine for zapproxy with hsts enabled sites. can you help to figure out this issue. i have added the certificate in Trusted authority in browsers .

PortSwigger Agent | Last updated: Jul 14, 2016 10:14AM UTC

To access HTTPS sites without errors you need to install Burp's CA certificate in your browser, as described here: https://support.portswigger.net/customer/en/portal/articles/1783075-Installing_Installing%20CA%20Certificate.html Once installed, you will be able to access HSTS sites without any SSL errors.

Burp User | Last updated: Jul 14, 2016 10:21AM UTC

i did already follow all these steps and installed the certificate . but still i am not able to access any stie with HSTS.

Burp User | Last updated: Jul 14, 2016 10:43AM UTC

ERROR "Cannot communicate securely with peer: no common encryption algorithm(s)."

PortSwigger Agent | Last updated: Jul 14, 2016 12:35PM UTC

In Firefox, please go to about:config, click through the warning, and change the value of security.tls.version.fallback-limit to 1.

Burp User | Last updated: Nov 24, 2016 09:03AM UTC

"In Firefox, please go to about:config, click through the warning, and change the value of security.tls.version.fallback-limit to 1" It's not working

PortSwigger Agent | Last updated: Nov 24, 2016 09:22AM UTC

Michal - Is your problem happening specifically with HSTS sites, and have you installed the Burp CA certificate?

Burp User | Last updated: Dec 01, 2016 12:57PM UTC

yes, I have also checked it. Its like a certificate pinning. So we cannot intercept even after installing port swigger certificate. Because chain of trust is not checked here. Still exploring if there is any way to view the traffic...

PortSwigger Agent | Last updated: Dec 01, 2016 02:15PM UTC

The JCE policy also applies to that version. The packaged installer versions of Burp include a private JRE, and you just need to install the JCE policy JAR into that JRE.

Burp User | Last updated: Jan 13, 2017 09:38PM UTC

Just install Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy and it should work. I had the same problem. Link: http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html

Burp User | Last updated: Jan 30, 2017 07:53PM UTC

The Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy seems to be only relevant if you run Burp as the JAR version. What about for the EXE or other versions of Burp?

Burp User | Last updated: Mar 12, 2018 03:51PM UTC

HTTPS traffic not getting intercepted in Chrome/Mozilla latest versions. I am a long term user of Burp and know how to configure Burp CA in firefox and chrome. Looks like some security implementation in new versions of all three major browsers, Firefox/Chrome and IE are preventing burp from intercepting HTTPS traffic. Any ideas ?

PortSwigger Agent | Last updated: Mar 12, 2018 04:20PM UTC

Hi Nutan, Thanks for your message. Can you explain a bit more about the specific problems you're having? We are able to intercept without issues using the latest Firefox, Chrome and IE. Please ensure you're using the latest version of Burp as we did make changes to certificate generation in 1.7.20.

Burp User | Last updated: Apr 17, 2018 05:55PM UTC

Make sure that your burp proxy listener certificate setting under Proxy-->Options is set as "Generate a CA-signed certificate with a specific hostaname"

Liam, PortSwigger Agent | Last updated: Apr 18, 2018 09:09AM UTC

Adrien, is there an option to enable trust for the certificate? As the Chrome browser picks up the certificate trust store from your host computer, you may need to access these settings the way you would for your native browser. For example, on iOS the settings are located at Keychain Access > Certificates > (Cert name) > Trust.

Burp User | Last updated: Jun 27, 2018 08:09AM UTC

burpsuite v1.7.34-40 google chrome 67.0.3396.99 Proxy ? Options ? Certificate set to "Genereate a CA-signed certificate with a specific hostname" Then export Certificate and private key in PKCS#12 keystore Then Import certificate in Chrome ? Manage certificate ? Your certificates. Then reload the website: ? You cannot visit example.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. Tried other types of certificates as well without success

Burp User | Last updated: Jun 27, 2018 08:16AM UTC

Note that the certificates shows up as UNTRUSTED in chrome certificates: https://i.imgur.com/r23DAvV.png

Burp User | Last updated: Sep 21, 2018 08:23AM UTC

Yes, I too faced this issue. But now, it's resolved. All I did is simply found a way to trust the certificates on Mac by going into Keychain->System->Certificates->Select Burp Certificate->Click on GetInfo->Select "Always Trust". All set, now no HSTS error.

Liam, PortSwigger Agent | Last updated: Sep 21, 2018 08:37AM UTC

Thanks for the update Ujjwal.

Burp User | Last updated: Dec 28, 2018 01:04PM UTC

Skip to the end for the thing that worked for me Here's the angry question I was going to leave publicly until I answered it myself while trying to justify my own angry message. ;) "Burp Certificate Does NOT Work in Mozilla Firefox 64.0 I'm just trying to follow the instructions for getting burp setup from bugcrowd. lol. They make it seem like it's as easy as opening notepad. Exported the Cert in DER Format, and again after regenerating and restarting burp I've imported the certificate into Mozilla under authorities It always says "This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate." For regular sites (google being the one I'm testing on). I've tried changing the listener between being invisible, self signing and generating CAs per host, forcing it to use SSL, and having intercept turned on and off. I've tried regenerating the cert, closing burp, and re exporting it and re importing it in Firefox. I've tried setting security.enterprise_roots.enabled to true in about:config I've tried changing security.tls.version.fallback-limit to 1 in about:config Reopening firefox multiple times for each permutation of these configurations I get that what we are doing here is invasive and all, but damn guys I've looked at some other responses to this problem: "DiD yOu ImPoRt It iNtO fIrEFox?", "DiD yOu FolLoW ThE InStRuCtIoNs?". It's not helpful. Do we support Firefox or not? I've tried things that make sense to me (not exactly seasoned with burp) written here: https://support.portswigger.net/customer/portal/questions/16358057-not-supporting-hsts https://support.portswigger.net/customer/portal/questions/11690068-web-pages-don-t-load-through-proxy-is-this-normal- Turns out foxyproxy is a tit and using firefoxs built in proxy stuff works."

PortSwigger Agent | Last updated: Dec 28, 2018 01:32PM UTC

Thanks for the info Judea, we'll bear this in mind when people report similar issues with Firefox.

Burp User | Last updated: Oct 15, 2019 02:40PM UTC

Hi, Just disable the hardware acceleration and you are good to go.

x | Last updated: Jan 26, 2022 06:49PM UTC

no idea why disabling hardware acceleration worked, I thought that was a joke, but that actually worked for me after trying to install burps CA cert and still having problems.

Praneeth | Last updated: Sep 30, 2022 04:11AM UTC

This worked for me https://portswigger.net/burp/documentation/desktop/external-browser-config/certificate/ca-cert-chrome. P.S: I had to restart my chrome to get this working.

Rohit | Last updated: Oct 24, 2023 08:48AM UTC