# Intercepting HTTPS on Android

DevFeed: [Intercepting HTTPS on Android](<https://devfeed.tech/articles/intercepting-https-on-android-19078.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/intercepting-android-https/>)

Author: HTTP Toolkit; Tim Perry

Published: 2020-11-05T16:45:00Z

Content type: tutorial

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Android](<https://devfeed.tech/topics/android.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [debug](<https://devfeed.tech/topics/debug.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [Mocking](<https://devfeed.tech/topics/mocking.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [capture](<https://devfeed.tech/tags/capture.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [http](<https://devfeed.tech/tags/http.md>), [interception](<https://devfeed.tech/tags/interception.md>), [mocking](<https://devfeed.tech/tags/mocking.md>), [testing](<https://devfeed.tech/tags/testing.md>), [tls](<https://devfeed.tech/tags/tls.md>), [validation](<https://devfeed.tech/tags/validation.md>)

## AI overview

This tutorial explains how HTTPS clients establish trust through TLS certificate authorities and chains, then discusses intercepting HTTPS traffic from Android devices for inspection, debugging, testing, and mocking without simply disabling certificate validation.

## Source excerpt

To intercept, inspect or manipulate HTTPS traffic, you need the HTTPS client to trust you. If you want to intercept your own HTTPS on Android, perhaps to capture & rewrite traffic from your Android device for debugging or testing, how do you do that? This isn't theoretical - HTTP Toolkit does exactly this, automatically intercepting HTTPS from real Android devices, for inspection, testing & mocking. To do so, it has to automatically ensure that it's trusted by HTTPS clients on Android devices, without breaking security on those devices completely (it would be a very bad idea to simply turn off certificate validation, for example). Here's a demo: Let's talk though how HTTPS clients in general manage this kind of trust, see how that works on Android specifically, and then look at how it's possible to get around this and intercept real HTTPS traffic. How HTTPS trust works An HTTPS request is an HTTP request, made over a TLS connection. Everything we're going to talk about here is really about TLS - the HTTP within is just normal GET / requests and 200 OK responses. I'm not going to go into the lowest level details, but it is important to understand the basics of how TLS works. If you are interested in the fine details of TLS, The Illustrated TLS Connection is well worth a look, for a byte-by-byte breakdown of the whole process. The high-level summary is this: Every TLS client keeps track of some set of root certificate authorities (root CAs) that it trusts completely. When any modern TLS client first connects to a server, its initial message includes a Server Name Indication (SNI), telling the server which hostname it's looking for (e.g. example.com). It expects the server's response to include a valid certificate for that hostname. TLS certificates include a reference to the issuer of the certificate, and a signature proving that the issuer verified the certificate. The issuer's certificate in turn will have its own issuer & signature, creating a chain of certificates