Wireguard mode and Certificates

[hexpwn]

I have been using mitmproxy and mitmweb to inspect Android apps for a while, without any issues.
I installed the certificate on my device using the magisk addon.

The issue is that now I tried using Wireguard mode and the applications are complaining about the certificate:

[12:24:39.722][10.0.0.1:50906] server connect 208.80.154.224:443
[12:24:39.920][10.0.0.1:50906] Client TLS handshake failed. The client does not trust the proxy's certificate for www.wikipedia.org (tlsv1 alert unknown ca)
[12:24:39.921][10.0.0.1:50906] client disconnect
[12:24:39.921][10.0.0.1:50906] server disconnect 208.80.154.224:443

Is Wireguard using a different certificate than mitmproxy? Can I force it to use the certificate I already have installed on my device?

I have seen the discussion on #5753 but I believe my case is different because I can get it to work without Wireguard.

[mhils]

mitmproxy's TLS certificate machinery is the same in all proxy modes, so things should work equally well in WireGuard mode. Does this affect all apps?

[hexpwn]

So far I have only found one app that is giving me issues. And it's one particular endpoint, of that app, that is having issues, the others are fine. Which definitely hints to SSL pinning I believe; but still I don't understand why it works fine with mitmproxy via proxy and not with Wireguard.

Client TLS handshake failed. The client does not trust the proxy's certificate for api.XXXXXXX.com (OpenSSL Error([('SSL routines', '', 'sslv3 alert certificate unknown')]))

edit: make that two apps, same endpoint. and again, both work when I'm not using wireguard.

[mhils]

One potential explanation could be that the app respects user-added CAs only if proxy settings are configured (to be compatible with corporate middleboxes)? Can you configure an HTTP proxy on top of WireGuard and see if that fixes things?

[hexpwn]

I think it had something to do with saved data on ~/.mitmproxy (?) I tried deleting it, which lead then to ALL endpoints being rejected by the application once the folder was refreshed. Now I'm working on the bigger issue of getting mitmproxy to work at all with my Android. :)

[hexpwn]

After fixing some things I managed to replicate the issue.
Fresh install of mitmproxy, fresh install of the certificates on my phone. Fresh install of the target APKs.
I can get the endpoint to work fine with mitmproxy via normal proxy mode, but the endpoint does not work with --mode wireguard. So the behaviour is not caused by "stale SSL data" in ~/.mitmproxy as I thought might be the case.

[hexpwn]

One potential explanation could be that the app respects user-added CAs only if proxy settings are configured (to be compatible with corporate middleboxes)? Can you configure an HTTP proxy on top of WireGuard and see if that fixes things?

I will try this next. Good idea.

[hexpwn]

Maybe I did this incorrectly, but I setup a proxy from my phone to the machine running mitmproxy; to port 8080.
Still, the TLS handshake for that problematic subdomain does not work.