5

I'm behind a proxy and some websites don't work, in particular ones related to MacOS update, app store etc. I imported the proxy certificate to the MacOS keychain. When I go to https://apps.apple.com with Safari I can't proceed to the website even if I add the certificate manually to the trust store. The error during visiting the site is:

"certificates do not meet pinning requirements".

The same site works when using Chrome which also uses KeyChain. So Safari and other native MacOS apps still seem to do something different and sometimes ignore certificates for proxies. Is there some way to disable this pinning?

openssl output of the certificate:

https://pastebin.com/Wehh35XK

Improve this question
5
  • I'm not sure certificate pinning is your actual problem. Can you include a screenshot of the details of the certificate you have created? (the proxy certificate) - for example a screenshot from Chrome where you say it works. I'm thinking that there's a problem with the information you put in there.
    – jksoegaard
    Feb 23, 2022 at 23:41
  • What would be the problem with the certificate of the proxy? The proxy works for almost all domains on various operating systems. Exceptions are the ones pinned by Apple. Apple also publishes a list on which domains to whitelist: support.apple.com/en-us/HT210060 So the issue is on Apples side. Question is how to work around that.
    – certpinner
    Feb 24, 2022 at 18:51
  • I think you're jumping to conclusions. Are you not willing to share the details of the certificate, or what is the problem exactly? - There are many detailed requirements you have to follow when creating the certificates in order for them to be accepted everywhere - in particular Apple have requirements regarding for example the validity period of the certificates. This is similar to how Google have their own "special rules" that do not follow immediately from an RFC.
    – jksoegaard
    Feb 24, 2022 at 19:23
  • And no, there's no general switch to disable certificate pinning in every app. You have to go app by app and patch that out manually in most cases. Doing so breaks signature validation, so you'll have to disable GateKeeper, etc.
    – jksoegaard
    Feb 24, 2022 at 19:25
  • I added details for the certificate giving the error.
    – certpinner
    Feb 24, 2022 at 21:30

1 Answer 1

Reset to default
1

Apple explicitly marks *.apps.apple.com as being compatible with proxies.

You can use Apple services through a proxy if you disable packet inspection and authentication for traffic to and from the listed hosts. Exceptions to this are noted above. Attempts to perform content inspection on encrypted communications between Apple devices and services will result in a dropped connection to preserve platform security and user privacy.

I’m not sure there’s a viable way to defeat these security checks and allow pinning as you describe.

Improve this answer
6
  • Yes, he is using "packet inspection" - that's what he described in the question. For native apps that means he's stuck at pinning. For his specific error, he's talking about opening the site in Safari, which is slightly different, as it should use the standard Safari browser TLS validation.
    – jksoegaard
    Feb 24, 2022 at 22:28
  • Sure seems likely, @jksoegaard the system is intentionally designed to detect this and disabling pinning seems an odd way to go, but lets see what else surfaces
    – bmike ♦
    Feb 24, 2022 at 23:30
  • There is nothing more to surface I guess. The proxy is doing inspection and some Apple services don't like that.
    – certpinner
    Feb 24, 2022 at 23:35
  • I’ve made it explicit I don’t know a viable way and also hopefully made the title clearer @certpinner
    – bmike ♦
    Feb 24, 2022 at 23:51
  • @certpinner Well, I described in the comment above 4 hours ago that certificate pinning is not something you can generally disable... it is not something "Apple services do not like" - it's a specific feature in each client app on your own computer. You can disable that per-app by patching it out, as I described... but it's a lot of work - and you haven't said anything about why you want to do this.
    – jksoegaard
    Feb 24, 2022 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .