[question] client certificate authentication

[KrzysztofSe]

I'm using browsermob-proxy for testing a website. The website resides on a server that uses client-side certificate authentication. The client test environment consists of a Windows machine with IE browser and a couple of user certificates installed in a Windows cert store. Normally, when using the browser manually, upon connecting to the website the user is presented with a list of available valid certificates, selects one, and then is taken to the website.

I would like to set up the proxy so that it takes care of this client certificate selection - ideally I want to be able to specify the client cert file that the proxy should present to the server whenever there is a 401 response received. Is it possible with the way browsermob-proxy is implemented? If not, what is the best approach to solve this problem?

I was thinking about implementing this in the serverToProxyResponse method: when a 401 response is received, perform the authentication round just between proxy and the server, and return the final response to the client. Is that approach feasible? I'm happy to try and implement the functionality, but unfortunately my knowledge in this field is lacking and I would be grateful for some initial guidance. Thanks!

[Idan37S]

Hi,

Did you find any solution to your problem? I'm facing a similar one and looking for solutions..

[ReservedDeveloper]

I'd also be interested in a follow up here.

The documentation would seem to lean towards something akin to:

• Add the BMP root CA, used for re-signing traffic, to your target browser
  • Could be either default CA from repo or one generated and saved with RootCertificateGenerator
• Add your desired target certificate to the MITM trust store
• Set the MITM manager on the proxy
• Set proxy on webdriver

However, I appear only get an EMPTY_ERR_RESPONSE coming back. Using latest ChromeDriver and Selenium 3.3

I'd initially thought that the steps re: Using a Custom Certificate would be the route to go, but that seems more interested in the cert coming from server to proxy, not the one being sent to server from proxy.

Any insights would be appreciated!