Android：使用 SSL 碰撞连接到 Squid 代理不起作用

Question

I have a Squid proxy installed with HTTPS/SSL. When I install the generated certificate in Firefox and set the proxy, everything looks good -- that is, I can see all the HTTPS requests the Squid log files.

However, when I install the same certificate in my Android phone (and change the proxy setting), it seems to work only in the browser. I first change the proxy setting and pages didn't load, then I installed the certificate and all was good.

All other app I've tried yield in errors due to connection problems. I can see the CONNECT request in the Squid logs but no other requests (eg, GET, POST). I know that some app completely ignore the system proxy settings, but many use them.

The odd thing is that everything was working on an old Android 6.0 phone. Here the same apps where working perfectly fine using the proxy and relying on HTTPS requests. Now I have a newer Android 9.0 phone and all apps so far fail. The apps obviously use the proxy (seeing the CONNECT entries in the logs) but do not use/acknowledge the installed certificate.

I currently see the new phone or the new Android version as cause for the problem since it worked before with an older phone and Android version. How can I best track this issue down?

Answer 1

Android connects to specific domains to verify the connection. Add this bit to the the squid.conf :

# Mobile
acl google-servers dstdom_regex "/etc/squid/google.txt"
always_direct allow google-servers

next, create this file /etc/squid/google.txt with the following content:

(^|\.)android\.clients\.google\.com$
(^|\.)ggpht\.com$
(^|\.)google\.com$
(^|\.)www\.googleapis\.com$
(^|\.)gstatic\.com$
(^|\.)gvt1\.com$
(^|\.)1e100\.net$
(^|\.)google\.co\.uk$

to activate, run:

  ./squid -k reconfigure

Answer 2

"Since Android 7, apps ignore user provided certificates, unless they are configured to use them. As most applications do not explicitly opt in to use user certificates [...] we need to place our CA certificate in the system certificate store"

https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android/

However, this seems not to be easily done...