Repository: mitmproxy/mitmproxy

Issue:
iOS 13.3: Certificate installation instructions need improvement
#### Problem Description
After installing profile and activating it, Safari still shows websites as "not trusted" and apps show "network error"

#### Steps to reproduce the behavior:
1. Configure wifi to use mitmproxy
2. Install and activate profile from mitm.it
3. Navigate anywhere in Safari

refs https://github.com/mitmproxy/mitmproxy/issues/3649 (added EKU) and #3647 

#### System Information
Paste the output of "mitmproxy --version" here.

```
Mitmproxy: 5.0.0
Python:    3.7.5
OpenSSL:   OpenSSL 1.1.1d  10 Sep 2019
Platform:  Darwin-19.2.0-x86_64-i386-64bit
```


Discussion:
Yes, this should work in 5.0. Did you delete your ~/.mitmproxy folder and then reinstall the certificate on your device (https://docs.mitmproxy.org/stable/concepts-certificates/#installing-the-mitmproxy-ca-certificate-manually)?
> Did you delete your ~/.mitmproxy folder and then reinstall the certificate on your device (https://docs.mitmproxy.org/stable/concepts-certificates/#installing-the-mitmproxy-ca-certificate-manually)?

I have only started working with mitmproxy just now, so no old settings. I will try explicit certificate trust on top of the profile installation and see if that works.
I finally found out how to run all of this.
### My settings

``` bash
mitmproxy --version
  Mitmproxy: 5.0.0
  Python:    3.7.5
  OpenSSL:   OpenSSL 1.1.1d  10 Sep 2019
  Platform:  Darwin-18.7.0-x86_64-i386-64bit
```

iPhone XS (current latest OS).

### Step-by-step
#### Macbook
1) `brew install mitmproxy`
2) run `mitmweb` for web interface
3) in new Terminal window run `ifconfig` to find out your laptop local IP address (probably starts with `192.168. ... `)

#### iPhone
1) Open settings -> Wi-Fi -> "your Wi-Fi network" -> Configure Proxy
2) Insert into "Server" your local laptop's IP and default port "8080"
3) In Safari open website 'mitm.it' and install sertificate
4) Open Settings -> General -> Profiles -> mitmproxy -> Verify the sertificate

And now everything will be `Trusted` and `Awesome`! 
I've found that I need to add one more step. After following 1-4, I needed to trust the certificate as root certificate. This is apparently not achieved by installing the profile alone:

Goto Settings -> General -> Info -> Certificate Trust -> Mitmproxy and enabled "Trusted Root" (German screenshot below):

![IMG_5C7034BD2845-1](https://user-images.githubusercontent.com/184815/71243714-30e5bc80-2311-11ea-8f54-b67e1e132a49.jpeg)

Is this the expected behaviour? Add to docs? Otherwise good to close!

Thanks @ohld and @andig! Looks like we need to mention this more prominently.

We currently have it at 
https://docs.mitmproxy.org/stable/concepts-certificates/#installing-the-mitmproxy-ca-certificate-manually and on mitm.it: https://github.com/mitmproxy/mitmproxy/blob/master/mitmproxy/addons/onboardingapp/templates/index.html#L30. If you two could think about ways how you would not have missed it, I'd be super happy to merge a PR! 😃 
I was looking here https://docs.mitmproxy.org/stable/concepts-certificates/ which seems to suggest that on iOS I need to only install the profile according to `Quick setup`. 
`Installing the mitmproxy CA certificate manually`(the next chapter's name) is kinda misleading. I was not going for a manual install but *still* needed to accept the certificate at root. Imho, at least for iOS, that needs to be added to the `Quick Setup` chapter, too?
@andig: Didn't that display instructions for the extra steps on mitm.it? If it did, do we need to make them more prominent?
Here's what I'm seeing:

![IMG_0329](https://user-images.githubusercontent.com/184815/71350645-00e92400-2572-11ea-902e-40515c00c8a1.png)

![IMG_0330](https://user-images.githubusercontent.com/184815/71350649-05154180-2572-11ea-9734-e69b018745aa.png)

All information is there. It's more that- once the profile is installed- I immediately moved over to install the profile and never returned to read the remaining instructions.

Only suggestion I could make is to put a fat additional disclaimer on https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup, maybe something like:

> Click on the relevant icon, follow the setup instructions for the platform you’re on and you are good to go.

**NOTE**: after clicking the relevant  icon, additional installation steps are required. Make sure to fully read and follow instructions specific to your platform.

Maybe put everything in **bold**. I feel highlighting these more might help.
Also having this issue, removed ~/.mitmproxy on my system, then reinstalled certs/profile/enabled trusted root on ios 13.3

```
Mitmproxy: 5.0.0
Python:    3.7.5
OpenSSL:   OpenSSL 1.1.1d  10 Sep 2019
Platform:  Darwin-19.2.0-x86_64-i386-64bit
```

Edit: Definitely an issue with the IOS update, Burp proxy doesn't seem to work as well.
@andig: Thanks for sharing the screenshots! `mitm.it` lives at https://github.com/mitmproxy/mitmproxy/tree/master/mitmproxy/addons/onboardingapp. I'd be more than happy to merge a PR that improves the user experience here in some way. Some ideas:

1. We should definitely add a much more prominent "more steps needed" alert (red text?) for iOS so that the "Full Trust" instructions aren't overlooked.
2. We could also display more platform-specific icons, and then only show the platform, specific instructions. _Windows_, _Linux_, _macOS_, _iOS_, _Android_, _Firefox_, and _other_ would probably be a good start. Most of that should already be there, it's just a bit cluttered at the moment.
3. We could also do some User-Agent sniffing to highlight the correct choice for the given platform. Might be more of a gimmick than a useful feature.
yep dev Sit on 
I'm still having a related issue. I used mitm.it to install the cert and switch the setting on for Full Trust. After doing this, I will see some https traffic, but large amounts are traffic are missing.

I'm using it to validate that scripts like Google Tag Manager or Google Analytics are running and none of the network requests are coming over.
Is anyone else experiencing limited network requests? This is happening for both ios and macos. 
Android will collect all data (I'm using the same site for everything)
> This is happening for both ios and macos.

On macOS, I was setting the proxy in firefox for http and I should have set for both http and https.

For ios (13.3), is there an option to set a proxy for https explicitly? I was researching and something for Charles came up. They have an extra step at the end to enable server-side. 
https://benoitpasquier.com/charles-ssl-proxy-ios/#enable-ssl-proxy-on-charles 

Is anything like this needed for mitm? The same proxy session is collecting HTTPS on Android and now macOS browser. So I don't think it's a mitm configuration issue unless there's a setting specific to ios that I'm missing.
This might be the issue: [](https://support.apple.com/en-us/HT210176) It appears Apple will not trust certificates that do not have a validity period of 825 days or fewer. The mitmproxy certificiate expires in three years. 
@fjord66: Only the root CA does, which is permitted under Apple's policy I believe. The leaf certs currently have a validity of two years.
@mhils in certs.py I changed the DEFAULT_EXP to: DEFAULT_EXP = 63072000 and it worked to meet the new requirements 
Hi there! I have the next issue with current master
<< Cannot establish TLS with client (sni: fishkaapp.net): TlsException("SSL handshake error: SysCallError(-1, 'Unexpected EOF')",)
This can be reproduced just for specific applications inside the device. For Safari and Chrome mitmproxy works good.

**System Information**
Mitmproxy: 6.0.0.dev (+126, commit 4d6886a)
Python:    3.6.9
OpenSSL:   OpenSSL 1.1.1f  31 Mar 2020
Platform:  Linux-5.3.0-45-generic-x86_64-with-Ubuntu-18.04-bionic
iOS 13.3.1
Is the app using certificate pinning? This looks like the same error you see when apps are using certificate pinning 
@fjord66 I think you are right. It looks like this!
Just checked it - cert pinning was the issue :(
> @mhils in certs.py I changed the DEFAULT_EXP to: DEFAULT_EXP = 63072000 and it worked to meet the new requirements

This is working for me too! All https hits coming through. thanks!
@fjord66 and @MichaelStadtmiller: I am not on macOS, which makes testing a bit difficult. If I understand you correctly, you also need the Root CA certificate (the one in ~/.mitmproxy) to be valid for less than 825 days (DEFAULT_EXP)? It is not sufficient to have a leaf certificate (the certificate which mitmproxy generates on-the-fly during execution for the actual interception, signed by the root CA) with a reduced lifetime (DEFAULT_EXP_DUMMY_CERT)?
That is correct 
I just took the most recent master branch of mitmproxy, wiped my local CA, restarted mitmproxy, installed the profile with CA in an iPhone with iOS 13.4, enabled the full-trust setting for this mitmproxy CA.

I am able to browse all websites as usual and mitmproxy is tracking all flows as expected. My iOS Safari is properly showing the Lock symbol in the address bar. I can inspect and intercept flows as expected.

Resolving patch:
diff --git a/mitmproxy/version.py b/mitmproxy/version.py
--- a/mitmproxy/version.py
+++ b/mitmproxy/version.py
@@ -2,7 +2,7 @@
 import subprocess
 import sys
 
-VERSION = "6.0.0.dev"
+VERSION = "5.1.0"
 PATHOD = "pathod " + VERSION
 MITMPROXY = "mitmproxy " + VERSION
 
diff --git a/release/cibuild.py b/release/cibuild.py
--- a/release/cibuild.py
+++ b/release/cibuild.py
@@ -356,15 +356,6 @@ def build_docker_image(be: BuildEnviron):  # pragma: no cover
         "--file", "release/docker/Dockerfile",
         "."
     ])
-    subprocess.check_call([
-        "docker",
-        "build",
-        "--tag", be.docker_tag + "-ARMv7",
-        "--build-arg", "WHEEL_MITMPROXY={}".format(whl),
-        "--build-arg", "WHEEL_BASENAME_MITMPROXY={}".format(os.path.basename(whl)),
-        "--file", "release/docker/DockerfileARMv7",
-        "."
-    ])
 
 
 def build_pyinstaller(be: BuildEnviron):  # pragma: no cover
@@ -569,11 +560,10 @@ def upload():  # pragma: no cover
             "-u", be.docker_username,
             "-p", be.docker_password,
         ])
-        for variant in ["", "-ARMv7"]:
-            subprocess.check_call(["docker", "push", be.docker_tag + variant])
-            if be.is_prod_release:
-                subprocess.check_call(["docker", "tag", be.docker_tag + variant, "mitmproxy/mitmproxy:latest" + variant])
-                subprocess.check_call(["docker", "push", "mitmproxy/mitmproxy:latest" + variant])
+        subprocess.check_call(["docker", "push", be.docker_tag])
+        if be.is_prod_release:
+            subprocess.check_call(["docker", "tag", be.docker_tag, "mitmproxy/mitmproxy:latest"])
+            subprocess.check_call(["docker", "push", "mitmproxy/mitmproxy:latest"])
 
 
 if __name__ == "__main__":  # pragma: no cover


Test patch: