# Chrome 99 expands Certificate Transparency on Android, affecting HTTPS interception and debugging tools

DevFeed: [Chrome 99 expands Certificate Transparency on Android, affecting HTTPS interception and debugging tools](<https://devfeed.tech/articles/android-chrome-99-expands-certificate-transparency-breaking-all-mitm-dev-tools-19047.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/chrome-android-certificate-transparency/>)

Author: HTTP Toolkit; Tim Perry

Published: 2022-05-11T16:00:00Z

Content type: tutorial

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Certificate Transparency](<https://devfeed.tech/topics/certificate-transparency.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Android](<https://devfeed.tech/topics/android.md>), [Security](<https://devfeed.tech/topics/security.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [browsers](<https://devfeed.tech/tags/browsers.md>), [certificate-transparency](<https://devfeed.tech/tags/certificate-transparency.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [developer-tools](<https://devfeed.tech/tags/developer-tools.md>), [interception](<https://devfeed.tech/tags/interception.md>), [security](<https://devfeed.tech/tags/security.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

This article explains how Chrome 99's expansion of Certificate Transparency to all Android Chrome users affects HTTPS interception with trusted system CA certificates, including developer debugging tools. It describes why Certificate Transparency exists and discusses workarounds for debugging Chrome traffic on Android.

## Source excerpt

Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge problem for the many developer tools like HTTP Toolkit which install trusted system certificates into Android to intercept & debug app traffic. This doesn't appear in the main announcements anywhere, but buried deep in the enterprise release notes for Chrome v99 there's a small note that says: Certificate transparency is already enforced on desktop platforms, and for some Android users. Chrome 99 expands certificate transparency to all Android Chrome users. And with that small note, Chrome on Android become uninterceptable for all HTTP Toolkit users using rooted devices, and anybody else who actively installs and trusts their own system CA certificates. If you're running into an ERR_CERTIFICATE_TRANSPARENCY_REQUIRED error in Chrome while trying to debug your HTTPS traffic with some MitM debugging proxy, then this is affecting you too. Let's talk about how certificate transparency works, why this breaks, and how you can work around it to keep debugging HTTPS from Chrome on your Android device regardless. Certificate Transparency (CT) HTTPS certificates are issued and signed by Certificate Authorities (CAs) who are trusted by your browser & OS. That's great when it works, but sometimes it doesn't. CAs can make mistakes when issuing certificates, when verifying a client's identity beforehand, or through malice somewhere, and issue fraudulent certificates to people who shouldn't have them. For example, let's say a trusted CA issues a certificate for google.com to the wrong person (this actually happened, repeatedly). That issued certificate is incredibly powerful - whoever has it can freely intercept all traffic sent by anybody to Google.com and both see & modify that traffic, whilst browsers will show all users a padlock and tell them everything is totally fine & secure. Even worse though: attacks like this were