"Couldn't authenticate host" message for some hosts

[maxbgn]

Hello, first I want to thank you for this great open-source tool.
I've downloaded the code, and run the project Titanium.Web.Proxy.Examples.Basic for .net 4.6.1. My OS is Windows 10, Visual studio 2019.
The proxy works for google, facebook, etc, but does not work for this site. But when I try to navigate to some hosts, for example pay.vn.ua, I get the following error:

"Couldn't authenticate host pay.vn.ua with certificate *.vn.ua".

And Chrome shows the following error:
NET::ERR_CERT_COMMON_NAME_INVALID
Subject: *.vn.ua
Issuer: Titanium Root Certificate Authority

Can someone tell me, how to fix it? Thanks.

[maxbgn]

I thing I figured out why this is happening. The root domain vn.ua does not support ssl connection.
I hardcoded the name "pay.vn.ua" as a host name, instead of "*.vn.ua", whitch was set as an extension X509Extensions.SubjectAlternativeName.Id to certificateGenerator, and the site was loaded successfully.
Should the proxy itself handle the situation, where the root domain does not support SSL ?

[tungpcco]

Please check in CertificateManager.cs.
The problem got at the Load certificate is null and will show the error "Couldn't authenticate host"
I think the task create certificate takes a long time and I still try to improve this function.
If you can. please together with me to fix it.

Please check here:

if (certificate == null)
                    {
                        certificate = makeCertificate(certificateName, false);

                        //Don't need to wait for save to complete
                        _ = Task.Run(() =>
                        {
                            try
                            {
                                var lockKey = subjectName.ToLower();
                                //acquire lock by subjectName
                                //Async lock is not needed. Since this is a rare race-condition
                                lock (saveCertificateLocks.GetOrAdd(lockKey, new object()))
                                {
                                    try
                                    {
                                        //no two tasks with same subject name should together enter here 
                                        certificateCache.SaveCertificate(subjectName, certificate);
                                    }
                                    finally
                                    {
                                        //save operation is complete. Free lock from memory.
                                        saveCertificateLocks.TryRemove(lockKey, out var _);
                                    }
                                }
                            }
                            catch (Exception e)
                            {
                                ExceptionFunc(new Exception("Failed to save fake certificate.", e));
                            }
                        });
                    }

[tungpcco]

I have to try at the BouncyCastle mode and still try to fix it at this mode.

[tungpcco]

I have try it :))

/// <summary>
        ///     Create an SSL certificate
        /// </summary>
        /// <param name="certificateName"></param>
        /// <param name="isRootCertificate"></param>
        /// <returns></returns>
        internal X509Certificate2? CreateCertificate(string certificateName, bool isRootCertificate)
        {
            LA001:
            X509Certificate2? certificate;
            try
            {
                if (!isRootCertificate && SaveFakeCertificates)
                {
                    string subjectName = ProxyConstants.CNRemoverRegex
                        .Replace(certificateName, string.Empty)
                        .Replace("*", "$x$");

                    try
                    {
                        certificate = certificateCache.LoadCertificate(subjectName, StorageFlag);

                        if (certificate != null && certificate.NotAfter <= DateTime.Now)
                        {
                            ExceptionFunc(new Exception($"Cached certificate for {subjectName} has expired."));
                            certificate = null;
                        }
                    }
                    catch (Exception e)
                    {
                        ExceptionFunc(new Exception("Failed to load fake certificate.", e));
                        certificate = null;
                    }

                    if (certificate == null)
                    {
                        certificate = makeCertificate(certificateName, false);
                        
                        //Don't need to wait for save to complete
                        _ = Task.Run(() =>
                        {
                            try
                            {
                                var lockKey = subjectName.ToLower();
                                //acquire lock by subjectName
                                //Async lock is not needed. Since this is a rare race-condition
                                lock (saveCertificateLocks.GetOrAdd(lockKey, new object()))
                                {
                                    try
                                    {
                                        //no two tasks with same subject name should together enter here 
                                        certificateCache.SaveCertificate(subjectName, certificate);
                                    }
                                    finally
                                    {
                                        //save operation is complete. Free lock from memory.
                                        saveCertificateLocks.TryRemove(lockKey, out var _);
                                    }
                                }
                            }
                            catch (Exception e)
                            {
                                ExceptionFunc(new Exception("Failed to save fake certificate.", e));
                            }
                        });
                    }
                }
                else
                {
                    certificate = makeCertificate(certificateName, isRootCertificate);
                }
            }
            catch (Exception e)
            {
                ExceptionFunc(e);
                certificate = null;
            }
            while (certificate == null) {
                Thread.Sleep(100);
                goto LA001;
            }
            return certificate;
        }

[fahlisaputra]

Is it resolved? If not..
I had the same problem and fix this with some changes of the code in Helpers\HttpHelpers.cs

`internal static string GetWildCardDomainName(string hostname)
{
// only for subdomains we need wild card
// example www.google.com or gstatic.google.com
// but NOT for google.com or IP address

        if (IPAddress.TryParse(hostname, out _))
        {
            return hostname;
        }

        if (hostname.Split(ProxyConstants.DotSplit).Length > 2)
        {
            // do not create wildcard if country code domain like: .ac.id, .co.id
            string[] prefix = hostname.Split('.');
            if (prefix[1].Length <= 3)
            {
                return hostname;
            }

            int idx = hostname.IndexOf(ProxyConstants.DotSplit);

            // issue #352
            if (hostname.Substring(0, idx).Contains("-"))
            {
                return hostname;
            }

            string rootDomain = hostname.Substring(idx + 1);
            return "*." + rootDomain;
        }

        // return as it is
        return hostname;
    }`

[delebash]

I think I am having a similar problem. Fiddler Classic picks up this url in it's session list https://launcher-public-service-prod06.ol.epicgames.com.

However, titanium does not list this url session. It is picking up https requests fine and the only other difference I can tell with this url request is that the user-agent is not Mozilla it is an App name.

[justcoding121]

Did you try proxyServer.CertificateManager.DisableWildCardCertificates = true; in latest beta version.

See #920

[delebash]

I am new to this so thanks for getting back to me and being patient.

I enabled this on the example Wpf app. but it did not work. It does pick normal https web traffic and some traffic on the Unreal Launcher app. However, there is a lot more traffic on the Unreal Launcher app that is not being picked up. Again, the stuff not being picked up does not have the Mozilla header. After reading some information on sniffers and proxies can you clarify that I am correctly understanding the process. In order for the proxy to work at all the applications must be told to use the proxy at port 8000 which is the default explicit port. So they should be pointed to 127.0.0.1:8000. I have verified my internet options and I do not have anything pointing towards the proxy server. Since this is the case, I would expect nothing to show up when I run the Wpf example, however this is not the case. I am on Windows 11 and also checked the Windows proxy settings and verified it was set at default to automatic but nothing specifically pointing to 8000. Even with these settings I am seeing internet traffic. Why? Regarding Transparent proxy, this should catch all traffic without having to point any application to the 8001 port proxy server, correct? I tried setting up port forwarding on Windows 11 using netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=443 connectport=8000 connectaddress=127.0.0.1 but this did not seem to work.

So in my current setup I should not be picking up any traffic at all.
If I setup my internet options proxy to point to 127.0.0.1 I should pickup all internet traffic
Some of the internet traffic for the Unreal Launcher is being pick up but more is not being picked up specifically the traffic which does not contain the Header Mozilla.

Thank you very much for responding!