在Safari，IE和iOS设备上使用Fiddler信任证书并捕获流量

Question

I have set-up my Fiddler Proxy like in the gist here . 我已经在这里设置了我的Fiddler代理。

Code: 码：

public class ProxyConfig
    {
        private readonly string _secureEndpointHostname = IPAddress.Any.ToString();
        private readonly int _secureEndpointPort = 4555;
        private readonly int _port = 18882;

        private static readonly ICollection<Session> AllSessions = new List<Session>();

        private static Fiddler.Proxy _secureEndpoint;

        private static readonly LoggerCnx Logger = new LoggerCnx();
        private Action<string> onRequest;

        public ProxyConfig()
        {
        }

        public ProxyConfig(Action<string> onRequest)
        {
            this.onRequest = onRequest;
        }

        public void SetupProxyListener()
        {
            FiddlerApplication.SetAppDisplayName("FiddlerCoreProxyApp");

            // This is a workaround for known issue in .NET Core - https://github.com/dotnet/coreclr/issues/12668
            CultureInfo.DefaultThreadCurrentUICulture = new CultureInfo("en-US");

            // Simply echo notifications to the console.  Because Fiddler.CONFIG.QuietMode=true 
            // by default, we must handle notifying the user ourselves.
            //Fiddler.FiddlerApplication.OnNotification += delegate (object sender, NotificationEventArgs oNEA) { System.Diagnostics.Debug.WriteLine("** NotifyUser: " + oNEA.NotifyString); };
            FiddlerApplication.Log.OnLogString += delegate (object sender, LogEventArgs oLEA) { Logger.Info("** LogString: " + oLEA.LogString); };

            FiddlerApplication.BeforeRequest += delegate (Session session)
            {

                if (!CertMaker.rootCertIsTrusted())
                {
                    CertMaker.trustRootCert();
                }

                if (onRequest != null)
                {
                    onRequest(session.fullUrl);
                }

                // In order to enable response tampering, buffering mode MUST
                // be enabled; this allows FiddlerCore to permit modification of
                // the response in the BeforeResponse handler rather than streaming
                // the response to the client as the response comes in.
                session.bBufferResponse = false;
                lock (AllSessions)
                {
                    AllSessions.Add(session);
                    Logger.Info("Session: " + session.fullUrl);
                }
                session["X-AutoAuth"] = "(default)";

                if ((session.oRequest.pipeClient.LocalPort == _secureEndpointPort) && (session.hostname == _secureEndpointHostname))
                {
                    session.utilCreateResponseAndBypassServer();
                    session.oResponse.headers.SetStatus(200, "OK");
                    session.oResponse["Content-Type"] = "text/html; charset=UTF-8";
                    session.oResponse["Cache-Control"] = "private, max-age=0";
                    session.utilSetResponseBody("<html><body>Request for httpS://" + _secureEndpointHostname + ":" + _secureEndpointPort.ToString() + " received. Your request was:<br /><plaintext>" + session.oRequest.headers.ToString());
                }
            };

            Logger.Info($"Starting {FiddlerApplication.GetVersionString()}...");
            CONFIG.IgnoreServerCertErrors = true;
            CONFIG.bCaptureCONNECT = true;

            FiddlerApplication.Prefs.SetBoolPref("fiddler.network.streaming.abortifclientaborts", true);

            FiddlerCoreStartupFlags startupFlags = FiddlerCoreStartupFlags.Default;

            startupFlags = (startupFlags | FiddlerCoreStartupFlags.DecryptSSL);
            startupFlags = (startupFlags | FiddlerCoreStartupFlags.AllowRemoteClients);
            startupFlags = (startupFlags & ~FiddlerCoreStartupFlags.MonitorAllConnections);
            startupFlags = (startupFlags & ~FiddlerCoreStartupFlags.CaptureLocalhostTraffic);

            FiddlerApplication.Startup(_port, startupFlags);

            Logger.Info("Created endpoint listening on port {0}", _port);

            Logger.Info("Starting with settings: [{0}]", startupFlags);
            Logger.Info("Gateway: {0}", CONFIG.UpstreamGateway.ToString());

            // Create a HTTPS listener, useful for when FiddlerCore is masquerading as a HTTPS server
            // instead of acting as a normal CERN-style proxy server.
            _secureEndpoint = FiddlerApplication.CreateProxyEndpoint(_secureEndpointPort, true, _secureEndpointHostname);
            if (null != _secureEndpoint)
            {
                Logger.Info("Created secure endpoint listening on port {0}, using a HTTPS certificate for '{1}'", _secureEndpointPort, _secureEndpointHostname);
            }
        }
    }

Its purpose is to capture and analyze traffic from Windows, Mac OS X, Android and iOS browsers (Chrome, Firefox and Safari mostly, on both Desktop and Mobile devices). 其目的是捕获和分析来自Windows，Mac OS X，Android和iOS浏览器（主要是桌面和移动设备上的Chrome，Firefox和Safari）的流量。

So far, it seems to be working on: 到目前为止，似乎正在努力：

Windows browsers: Chrome, Firefox. Windows浏览器：Chrome，Firefox。 Not working on IE and Edge 不适用于IE和Edge
Android: Chrome Android：Chrome
Mac OS: Chrome, Firefox. Mac OS：Chrome，Firefox。 Safari is not working Safari无法正常工作
iOS: none iOS：没有

In my logs files I'm seeing the following errors logged by Fiddler on browsers not working (for all devices). 在我的日志文件中，我看到Fiddler在浏览器无法正常工作（所有设备）上记录以下错误。 Example for an HTTPS request: HTTPS请求的示例：

2018-02-14 17:25:50.3860 | 2018-02-14 17：25：50.3860 | INFO | 信息| ** LogString: !SecureClientPipeDirect failed: System.IO.IOException Authentication failed because the remote party has closed the transport stream. ** LogString：！SecureClientPipeDirect失败：System.IO.IOException身份验证失败，因为远程方已关闭传输流。 for pipe (CN=*.optimizely.com, O=DO_NOT_TRUST_BC, OU=Created by http://www.fiddler2.com ) for pipe（CN = *。optimizely.com，O = DO_NOT_TRUST_BC，OU =由http://www.fiddler2.com创建）

From what I read in the last couple of day trying to figure out a solution for this, the reason would be the certificates that are not trusted on the device. 从我在过去几天读到的试图为此找到解决方案的内容来看，原因是设备上不信任的证书。

The tests are being ran on BrowserStack using the feature they provide called BrowserStack Local. 这些测试使用他们提供的名为BrowserStack Local的功能在BrowserStack上运行。 Details about it are here and here . 有关它的详细信息在这里和这里。

Now my questions could be split between Desktop and Mobile: 现在我的问题可以分为桌面和移动：

Why is Chrome and Firefox able to make HTTPS requests while IE, Edge and Safari fails to do so? 为什么Chrome和Firefox能够在IE，Edge和Safari无法做到的情况下发出HTTPS请求？
For iOS specifically, there's a Fiddler for iOS documentation here specifying the steps required in order to configure the device. 对于iOS，特别是这里有一个Fiddler for iOS文档，指定了配置设备所需的步骤。 However, as I already mentioned, I'm not using in-house iOS devices, but physical ones provided by BrowserStack. 但是，正如我已经提到的，我不使用内部iOS设备，而是使用BrowserStack提供的物理设备。 Is there a way to programatically trust a certificate on an iOS device (iOS 9.x, iOS 10.x, iOS 11.x)? 有没有办法以编程方式信任iOS设备（iOS 9.x，iOS 10.x，iOS 11.x）上的证书？

Are there any workarounds that I could use? 我可以使用任何变通方法吗？

EDIT: FiddlerCore and BrowserStack Local logs are here. 编辑： FiddlerCore和BrowserStack本地日志在这里。

Answer 1

Starting from your second question, there is a discussion regarding IOS devices here on the official Telerik forums stating: 从您的第二个问题开始，官方Telerik论坛上有关于IOS设备的讨论说明：

SSL2 shouldn't ever be enabled, and it isn't enabled in Fiddler unless you go out of the way to shoot yourself in the foot. 不应该启用SSL2，并且除非你不再用脚射击自己，否则它不会在Fiddler中启用。

If you've properly configured your iOS device to trust Fiddler's root certificate, then HTTPS interception will work properly in clients except where certificate pinning is in use. 如果您已正确配置iOS设备以信任Fiddler的根证书，则HTTPS拦截将在客户端中正常工作，除非正在使用证书固定。 While Certificate Pinning in Chrome won't matter on the Desktop, on iOS they ignore the Trusted Certificates store and as a consequence Fiddler interception will not work. 虽然Chrome中的证书固定在桌面上无关紧要，但在iOS上他们会忽略受信任的证书存储，因此Fiddler拦截将无效。 But most sites and apps do not use pinning. 但大多数网站和应用程序都不使用固定。 If a site or app uses pinning, there's no workaround short of jailbreaking the device. 如果网站或应用程序使用固定，则没有办法解决设备越狱问题。 This isn't a limitation unique to Fiddler-- every HTTPS-decrypting proxy has exactly the same limitation. 这不是Fiddler独有的限制 - 每个HTTPS解密代理都有完全相同的限制。

I guess that will answer your first answer as well as IE is using certificate pinning as well as much as I recall. 我想这将回答你的第一个答案以及IE正在使用证书固定以及我记得的内容。

在Safari，IE和iOS设备上使用Fiddler信任证书并捕获流量

问题描述

1 个解决方案

解决方案1
4 2018-02-21 10:04:34

在Safari，IE和iOS设备上使用Fiddler信任证书并捕获流量

问题描述

1 个解决方案

解决方案1 4 2018-02-21 10:04:34

解决方案1
4 2018-02-21 10:04:34