‫-: Hi. Within this lecture, we are going to see
‫how we can install the SSL certificates from Charles
‫and now we're going to learn how to use it
‫in an app later on.
‫So as you can see
‫I can browse the HTTP websites, but not the HTTPS ones.
‫So in order to resolve this issue
‫I'm going to open this website in my emulator
‫So chls.pro and /ssl.
‫So this is basically Charles proxy SSL, chls.pro/ssl.
‫And make sure Charles proxy is opened when you do that.
‫So it'll ask you for your pin, okay?
‫And if you don't have a pin on your emulator
‫it'll ask you to create one.
‫Because that's how you can install certificates.
‫And over here in the Charles menu,
‫if you go to SSL proxying and say,
‫install charles root certificate on a mobile device,
‫it'll actually give you this instruction.
‫So make sure you do that
‫and make sure you find this website over here. Okay?
‫And as you can see it says that,
‫configure your HTTP proxy.
‫Yeah, we have already done that.
‫And as you can see it says that
‫go to this charles.pro/ssl
‫to download and install your certificate.
‫So if it asks you to go to a different website
‫then you should go to that website specifically.
‫And over here it will ask you for your pin. Okay?
‫And if you don't have a pin, you can create your own
‫from your emulator, obviously, like in a real device, okay?
‫And when you give that pin,
‫it will try to install the certificate
‫that you're trying to download.
‫So having a pin is only way to install certificates
‫on Android phones, even if it does not
‫make any sense to create a pin just for that purpose.
‫It's still the case.
‫Just give your password, give your pin,
‫and it will try to install it.
‫And as you can see, I have a crash over here
‫and I will try it one more time.
‫And certificate installer has stopped, for some reason.
‫I believe this is kind of a bug that we encounter
‫in this emulator.
‫So I can try to install it couple of times,
‫but if it doesn't work for you,
‫just don't be stubborn over this emulator.
‫So we are not doing anything wrong over here
‫but it doesn't work.
‫So what I'm going to do, I'm going to just
‫open another emulator, from my android studio
‫and try with that, right?
‫So I can actually close this down
‫and I'm in my secure tweet app
‫which is not actually the case in many of times
‫that you won't have the source code
‫but I'm not going to run the secured tweet app.
‫I'm going to run any emulator from any project. Okay?
‫I just opened the android studio
‫in order to run the emulator.
‫So you don't have to have the source codes
‫in order to do the following thing.
‫Just make sure you open the emulator, okay?
‫And try with this one.
‫So this is a different SDK, so this is a different API.
‫So if you don't have any second emulator
‫you can create it from your AVD manager.
‫So let me uninstall the secure tweet app from here, okay?
‫And let me install the current APK that we are working on.
‫So let me just open the settings.
‫So here you go.
‫Let me open the settings from here because we need to
‫configure the proxy.
‫It's already configured for me.
‫If it doesn't work for you
‫you have to configure from scratch.
‫So make sure you open the settings
‫and make sure you open the wifi.
‫And here you go.
‫I have the Android wifi, and as you can see
‫I don't get the modify network over here.
‫So as I said before,
‫it's different in different versions.
‫So over here I have the modify button over here.
‫So I'm gonna go for manual proxy.
‫So let me go for proxy manual. Yep.
‫So my local IP is 192 168 121 and the port is 8888.
‫And say, okay.
‫So we already have done this before,
‫so I'm going to go a little faster over here.
‫So I'm going to open the Chrome and I'm going to
‫open the charles.pro/ssl one more time, like this, chls.
‫And yep, it will ask me to create a certificate name.
‫I'm gonna say charles test or something.
‫Okay, charles proxy, maybe test.
‫And I'm going to say, yeah, use it for VPN and apps.
‫And here you go.
‫Now it's installed.
‫So I have managed to install the SSL proxy.
‫So let me try to go to the website
‫that I haven't actually opened before, like hotmail.com.
‫This is an HTTPS website.
‫And as you can see now we are able to open it,
‫and I believe we can open my website as well, from here.
‫Let me try this.
‫So far we couldn't open it before, right?
‫So now it must work.
‫And here you go.
‫Now it's working, right?
‫Yep, here you go.
‫Now we can see my website.
‫So even though it's working right now,
‫we can get the HTTPS data from here.
‫We cannot actually see the traffic from our app.
‫So if I open it, it won't come,
‫over here, we cannot see the connections to firebase
‫or responses from firebase, in detail at least.
‫The reason for that, apps do not trust,
‫the certificates that user has installed on their phone.
‫In order for apps to trust the certificate,
‫developers should allow the app to trust the certificates.
‫And most of the developers do not have that intention. Okay?
‫And if you search the internet for SSL capturing
‫from the apps, you will see outdated versions.
‫This has been changed three years ago
‫and before 2000, I believe 17,
‫we would be able to get the data,
‫with only this kind of configuration.
‫But right now, we need to do some further configuration
‫to make our app to trust these certificates.
‫So make sure you uninstall the APK
‫because we are going to change it in a bit
‫and meet me in the next lecture to do so.