1

Not completely certain if it's better to post here or security, so, trying here first.

I'm currently attempting to test a new feature in a desktop application that uses 2 way pinning for https traffic. If the client certificate (built into the application) is not one that's expected, the server will return an error.

Normally, running something like Fiddler would be fine, but, because of the fact that the Fiddler uses it's own, we can not see the traffic coming back.

Is there a way in Fiddler to import a certificate that I haven't managed to find yet, or, is there another way to inspect this traffic?

1

If you haven't already looked into it you can register client certificates as mentioned http://docs.telerik.com/fiddler/configure-fiddler/tasks/RespondWithClientCert

You can also utilize Soapui to send communications with certificates, but that's just services...not sure if this is a service or part of the webapp...sounds like it's coded in the app.

If all else fails you can utilize wireshark to pull all the traffic out and from there try to filter for the specific traffic you are looking for and see that it is communicating as expected.

  • Unfortunately, it seems as though I'm not going to be able to test this until next week now, but, the fiddler solution appears as though it should work. Going to try to find another scenario like this to try it out before. – Lyndon Vrooman Aug 15 '14 at 18:22
  • The fiddler solution does certainly work. Thanks! – Lyndon Vrooman Aug 19 '14 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.