SSLPeerUnverifiedException: Certificate transparency failed: this must be patched manually

[CyberBishop]

Hi everyone,

I'm encountering an SSLPeerUnverifiedException when running frida with all the scripts.
SSLPeerUnverifiedException: Certificate transparency failed Thrown by L0.e->intercept

Spawned ``. Resuming main thread!
[Android Emulator 5554::]-> == Proxy system configuration overridden to 127.0.0.1:8000 ==
== Proxy configuration overridden to 127.0.0.1:8000 ==
== System certificate trust injected ==
== Certificate unpinning completed ==
== Unpinning fallback auto-patcher installed ==

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by L0.e->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by L0.e->intercept
[ ] Unrecognized TLS error - this must be patched manually

!!! --- Unexpected TLS failure --- !!!
SSLPeerUnverifiedException: Certificate transparency failed
Thrown by L0.e->intercept
[ ] Unrecognized TLS error - this must be patched manually

[CyberBishop]

I tried going through the blog post but this is my first time attempting reversing an application

    public final Interceptor a() {
        Set M02;
        Set M03;
        M02 = x.M0(this.includeHosts);
        M03 = x.M0(this.excludeHosts);
        return new e(M02, M03, this.certificateChainCleanerFactory, this.trustManager, this.logListService, this.logListDataSource, this.policy, null, this.failOnError, null);
    }

I suspect this is the function

com/appmattus
com/appmattus/certificatetransparency
com/appmattus/certificatetransparency/chaincleaner
com/appmattus/certificatetransparency/chaincleaner/AndroidCertificateChainCleaner.java
com/appmattus/certificatetransparency/chaincleaner/BasicCertificateChainCleaner.java
com/appmattus/certificatetransparency/chaincleaner/CertificateChainCleaner.java
com/appmattus/certificatetransparency/chaincleaner/CertificateChainCleaner$Companion$androidCertificateChainCleanerFactory$2.java
com/appmattus/certificatetransparency/chaincleaner/CertificateChainCleanerFactory.java

and I suspect this is the certificate Pinner being used

[CyberBishop]

@Override // okhttp3.Interceptor
    public Response intercept(Interceptor.Chain chain) {
        List<Certificate> h10;
        r.f(chain, "chain");
        String host = chain.request().url().host();
        Connection connection = chain.connection();
        if (connection == null) {
            throw new IllegalStateException("No connection found. Verify interceptor is added using addNetworkInterceptor");
        }
        Handshake handshake = connection.getHandshake();
        if (handshake == null || (h10 = handshake.peerCertificates()) == null) {
            h10 = C2568p.h();
        }
        if (((connection.socket() instanceof SSLSocket ? f(host, h10) : new f.c.b(host)) instanceof f.b) && this.failOnError) {
            throw new SSLPeerUnverifiedException("Certificate transparency failed");
        }
        return chain.proceed(chain.request());
    }

[CyberBishop]

// frida_bypass_ct.js
Java.perform(function () {
    var E = Java.use('L0.e');
    E.intercept.implementation = function(chain) {
        // Just skip the check and always proceed
        return chain.proceed(chain.request());
    };
});

this worked...used AI

would like to understand what is happening tho

[pimterry]

Nice, that makes sense! Yes, this Appmatus check is a common block. The normal hooks handle it over here:

frida-interception-and-unpinning/android/android-certificate-unpinning.js

Lines 405 to 411 in 185e91f

	'com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor': [
	{
	methodName: 'intercept',
	replacement: () => (a) => a.proceed(a.request())
	// This is not called unless the cert passes basic trust checks, so it's safe to blindly accept.
	}
	],

In your case, it's obfuscated, so the names are lost, and this normal hook doesn't match. Instead, what should happen is that this failure hits the 'fallback' script after the first failure, which looks at the structure of the code (even though the names are not available) and if it matches the expected structure it patches it automatically. For some reason that's failing though. If you have a minute, could you add some debugging and work out why? That happens here:

frida-interception-and-unpinning/android/android-certificate-unpinning-fallback.js

Lines 149 to 160 in 185e91f

	} else if (isAppmattusOkHttpInterceptMethod(errorMessage, failingMethod)) {
	// See Appmattus CertificateTransparencyInterceptor patch in unpinning script:
	const chainType = Java.use(failingMethod.argumentTypes[0].className);
	const responseTypeName = failingMethod.returnType.className;
	const okHttpChain = matchOkHttpChain(chainType, responseTypeName);
	failingMethod.implementation = (chain) => {
	if (DEBUG_MODE) console.log(` => Fallback Appmattus+OkHttp patch`);
	const proceed = chain[okHttpChain.proceedMethodName].bind(chain);
	const request = chain[okHttpChain.requestFieldName].value;
	return proceed(request);
	};
	console.log(` [+] ${className}->${methodName} (fallback Appmattus+OkHttp patch)`);

For some reason, isAppmattusOkHttpInterceptMethod must be returning false, but clearly it's should be returning true in this case. If you can work out which of the conditions in that check is causing it to return false and why then we can probably tweak this to cover your case properly.

[CyberBishop]

No problem, I would add debugging and work out why.

Thank you :)