How to decrypt SSL traffic in android app with java?

Question

I want to monitor all the traffic going through app or browser for that purpose i've used ToyShark VPN . It's working well for HTTP traffic but for HTTPS i can't get the complete URL as it is encrypted. So my question is how can i decrypt these URLs? I've tried installing SSL Certificate from DigiCertificate and used that key in my.network_security_config.xml like this

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>

    <!-- Official Android N API -->
    <!--https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html-->
    <domain-config>
        <domain>baltimore-cybertrust-root.chain-demos.digicert.com</domain>
        <trust-anchors>
            <certificates src="user" />
            <certificates src="system" />
        </trust-anchors>
        <pin-set>
            <!-- Pin for: currency-converter-demo.pdm.approov.io -->
            <pin digest="SHA-256">Fq9XqfZ2sKsSYJWqXrre8iqzERnWRKyVzUuT2/Pyaus=</pin>

            <!-- Backup Pin for: currency-converter-demo.pdm.approov.io -->
            <pin digest="SHA-256">47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=</pin>
        </pin-set>

        <!-- TrustKit Android API -->
        <!-- enforce pinning validation -->
        <trustkit-config enforcePinning="true" disableDefaultReportUri="true">
            <!-- Add a reporting URL for pin validation reports -->
            <report-uri>https://report.pdm.approov.io/pinning-violation/report</report-uri>
        </trustkit-config>
    </domain-config>

</network-security-config>

Now i need to make some code changes for decryption or what else is required? Apps like WireShark or Fiddler also decrypt what method or API do they use there must be some way to do the same in client side.

Answer 1

The trick is to run the HTTPS traffic through a TLS Inspection proxy (like Fiddler, mitmproxy, PolarProxy or SSLsplit), from which you will be able to get the decrypted traffic. To do this you'll need to configure the app/browser/phone to trust the root CA certificate of your TLS inspection proxy.