'HTTPS sniffing/Charles SSL doesn't work on Facebook
Charles SSL works on basically any other app or website except Facebook. I have installed all the certificates on iOS devices, but when sniffing Facebook only, I always get status Failed when method is CONNECT. What is wrong?
Solution 1:[1]
Probably using certificate pinning.
Find some info in the comments to the answers here:
How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
From a now deleted blog that explains it well:
Certificate Pinning is an extra layer of security that is used by applications to ensure that the certificate provided by the remote server is the one which is expected.
By including the remote server’s x509 certificate or public key within the application, it is possible to compare the locally stored certificate or key with the one provided by the remote server.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 |