SSL Cert Install Android ?

[dashpuppy]

Guys i'm playing around with SSL inspector on a separated VLan with a policy for that vlan to push all traffic out the new policy. I have SSL inspector turned on with a cert installed on a laptop and it's working. How do I get the cert to work properly with Android ? ( yes i have the SSID on the same vlan as the policy. I'm connected to the correct network.

Followed this,

https://support.securly.com/hc/en-us/articles/212869927-How-do-I-install-Securly-SSL-certificate-on-Android-device-

[jcoffin]

Android 11 has made it next to impossible to add a third party root certification.

https://httptoolkit.tech/blog/android-11-trust-ca-certificates/

[dashpuppy]

Thanks sir, Thought so, I tried

[jcoehoorn]

Even if you succeed, a lot of mobile apps now are doing something called "Certificate Pinning", whey they know what certificate they're supposed to see and will reject your replacement, even if it's otherwise trusted.

[dashpuppy]

Even if you succeed, a lot of mobile apps now are doing something called "Certificate Pinning", whey they know what certificate they're supposed to see and will reject your replacement, even if it's otherwise trusted.

So its more useful for laptops & desktops. Not mobile devices.

[sky-knight]

Soon it won't be useful at all, mTLS is the nature of the future and when you start using certificates to authenticate not only the server, but the client a uniform trust chain reveals any and all MITM attempts.

SSL Inspection was dead on arrival, that's why I never used it and never recommended its use. The "need" for it doesn't matter, the nature of the beast determines reality.

[dashpuppy]

So when you roll out "untangle" what packages to you sell / use ? the NG Firewall Complete ? or Pick and choose ?

[jcoehoorn]

We don't use a number of the apps at all...
Phish Block, Spam Blocker, Web Cache, and Ad Blocker aren't even installed. A couple others are installed but just turned off, including SSL Inspector.

That said, we use enough that the Complete package is still far and away our more cost-effective option.

[sky-knight]

Yeah, the way the pricing works if you want web filter + support, you're basically in for the entire complete package anyway. So I just push complete, the only time I do individual licenses is in the rare case that I need a multi-wan VPN terminator, then that unit will get just WAN failover / Balancer on it, and perhaps the IPSec module. But those units almost never stay that way long and wind up either going away, or getting complete soon thereafter anyway.

[dashpuppy]

Yeah, the way the pricing works if you want web filter + support, you're basically in for the entire complete package anyway. So I just push complete, the only time I do individual licenses is in the rare case that I need a multi-wan VPN terminator, then that unit will get just WAN failover / Balancer on it, and perhaps the IPSec module. But those units almost never stay that way long and wind up either going away, or getting complete soon thereafter anyway.

Thought so, I use policy manager alot & many of the other things. Hope to bring many videos out to help !