DEV Community

Cover image for HTTPS and Burp Certificates: Why Websites Suddenly Stop Working(#4)
Arashad Dodhiya
Arashad Dodhiya

Posted on

HTTPS and Burp Certificates: Why Websites Suddenly Stop Working(#4)

#burpsuite #cybersecurity #https #websecurity

You finally did it.

You installed Burp Suite.

Configured the proxy.

Opened your browser.

Visited Google.

And then...

Instead of seeing Google, you saw this:

Your connection is not private
Enter fullscreen mode Exit fullscreen mode

Or:

NET::ERR_CERT_AUTHORITY_INVALID
Enter fullscreen mode Exit fullscreen mode

Or:

Certificate Error
Enter fullscreen mode Exit fullscreen mode

At this point, most beginners think:

"I configured something wrong."

Or even worse:

"Burp Suite is broken."

The truth is much more interesting.

Burp isn't broken.

HTTPS is protecting you.

And understanding why this happens is one of the most important lessons in web security.

The Problem Burp Creates

Let's first remember what Burp does.

Normally:

Browser
   ↓
Website
Enter fullscreen mode Exit fullscreen mode

Your browser talks directly to the website.

But when Burp is introduced:

Browser
   ↓
Burp Suite
   ↓
Website
Enter fullscreen mode Exit fullscreen mode

Burp sits in the middle.

This creates a problem.

A very important problem.

HTTPS Was Designed to Prevent This

Imagine you're sending a confidential letter.

You place it inside a locked box.

Only the recipient has the key.

Even if someone intercepts the box, they cannot read the contents.

That's essentially what HTTPS does.

HTTPS encrypts communication between:

Browser
   ↔
Server
Enter fullscreen mode Exit fullscreen mode

So that nobody in the middle can read it.

Not:

  • Attackers
  • WiFi operators
  • ISPs
  • Network administrators

Nobody.

Only the browser and server should understand the contents.

What Happens When Burp Appears?

Now let's introduce Burp.

Browser
   ↓
Burp
   ↓
Website
Enter fullscreen mode Exit fullscreen mode

Burp needs to see the encrypted traffic.

But HTTPS says:

"Nobody in the middle should be able to read this."

So who wins?

HTTPS.

At least initially.

Why Browsers Start Complaining

Let's say you visit:

https://google.com
Enter fullscreen mode Exit fullscreen mode

Your browser expects:

Google Certificate
Enter fullscreen mode Exit fullscreen mode

Because it's talking to Google.

But Burp intercepts the traffic.

Now the browser sees:

Burp Certificate
Enter fullscreen mode Exit fullscreen mode

Instead of:

Google Certificate
Enter fullscreen mode Exit fullscreen mode

The browser immediately becomes suspicious.

It thinks:

"Wait a second..."

"I wanted Google's certificate."

"Who is this Burp guy?"

And it displays:

Your connection is not private
Enter fullscreen mode Exit fullscreen mode

Which is exactly what a secure browser should do.

The Hotel Reception Analogy

Imagine calling a hotel.

You expect to speak directly with reception.

You
 ↓
Hotel Reception
Enter fullscreen mode Exit fullscreen mode

Instead:

You
 ↓
Random Stranger
 ↓
Hotel Reception
Enter fullscreen mode Exit fullscreen mode

A stranger answers first.

Even if that stranger claims:

"Trust me, I'll relay your messages."

You would be suspicious.

That's exactly how the browser feels about Burp.

Why Burp Needs Its Own Certificate

Burp must convince the browser that it's trustworthy.

To do that, Burp creates its own Certificate Authority (CA).

Think of it as:

Burp CA
Enter fullscreen mode Exit fullscreen mode

Once your browser trusts the Burp CA:

Browser
   ↔
Burp
Enter fullscreen mode Exit fullscreen mode

becomes trusted.

And:

Burp
   ↔
Website
Enter fullscreen mode Exit fullscreen mode

remains encrypted as well.

Burp can now safely inspect traffic.

What Is a Certificate?

A certificate is like an identity card.

When you visit:

https://example.com
Enter fullscreen mode Exit fullscreen mode

The website presents a certificate.

The browser checks:

Is this certificate valid?
Enter fullscreen mode Exit fullscreen mode

If yes:

Connection Trusted
Enter fullscreen mode Exit fullscreen mode

If no:

Warning Message
Enter fullscreen mode Exit fullscreen mode

Certificates help prevent impersonation attacks.

Without certificates, attackers could pretend to be any website.

How Burp Handles HTTPS

Burp performs something called:

SSL/TLS Interception
Enter fullscreen mode Exit fullscreen mode

Don't worry about the fancy term.

Here's what actually happens.

Step 1

Browser requests:

https://google.com
Enter fullscreen mode Exit fullscreen mode

Step 2

Burp intercepts request.

Step 3

Burp generates a certificate for:

google.com
Enter fullscreen mode Exit fullscreen mode

on the fly.

Step 4

Browser checks:

Do I trust Burp?
Enter fullscreen mode Exit fullscreen mode

If not:

Certificate Error
Enter fullscreen mode Exit fullscreen mode

If yes:

Connection Successful
Enter fullscreen mode Exit fullscreen mode

Installing the Burp Certificate

Now let's fix the problem.

Method 1: Using Burp Browser (Recommended)

Launch:

Proxy
↓
Open Browser
Enter fullscreen mode Exit fullscreen mode

or:

Open Burp Browser
Enter fullscreen mode Exit fullscreen mode

depending on your version.

Modern Burp Browser usually installs and trusts the certificate automatically.

In many cases:

No manual steps required.
Enter fullscreen mode Exit fullscreen mode

This is one reason beginners should start with Burp Browser.

Installing the Certificate Manually

If you're using Chrome, Firefox, or another browser:

Follow these steps.

Step 1

Open Burp Suite.

Step 2

Open Burp Browser.

Navigate to:

http://burp
Enter fullscreen mode Exit fullscreen mode

or:

http://burpsuite
Enter fullscreen mode Exit fullscreen mode

Depending on the version.

You should see Burp's certificate page.

Step 3

Download:

CA Certificate
Enter fullscreen mode Exit fullscreen mode

A file similar to:

cacert.der
Enter fullscreen mode Exit fullscreen mode

will be downloaded.

Step 4

Import the certificate into your browser.

Firefox Installation

Firefox manages certificates separately.

Navigate:

Settings
 ↓
Privacy & Security
 ↓
Certificates
 ↓
View Certificates
 ↓
Authorities
 ↓
Import
Enter fullscreen mode Exit fullscreen mode

Select:

cacert.der
Enter fullscreen mode Exit fullscreen mode

Enable:

Trust this CA to identify websites
Enter fullscreen mode Exit fullscreen mode

Save.

Chrome Installation

Chrome uses your operating system's certificate store.

Windows:

Manage User Certificates
 ↓
Trusted Root Certification Authorities
 ↓
Import
Enter fullscreen mode Exit fullscreen mode

Select:

cacert.der
Enter fullscreen mode Exit fullscreen mode

Finish installation.

Restart Chrome.

How To Verify Everything Works

After certificate installation:

Visit:

https://google.com
Enter fullscreen mode Exit fullscreen mode

or:

https://portswigger.net
Enter fullscreen mode Exit fullscreen mode

If pages load normally:

✓ Proxy works

✓ Certificate works

✓ HTTPS interception works

You're ready.

How To Confirm Burp Is Seeing Traffic

Inside Burp:

Navigate:

Proxy
 ↓
HTTP History
Enter fullscreen mode Exit fullscreen mode

You should see:

GET https://google.com
Enter fullscreen mode Exit fullscreen mode

or other requests.

This confirms Burp is successfully decrypting and inspecting HTTPS traffic.

Common Beginner Mistakes

Installing Proxy But Not Certificate

Result:

Certificate Error
Enter fullscreen mode Exit fullscreen mode

Most common issue.

Importing Into Wrong Certificate Store

The certificate must be trusted by the browser being used.

Forgetting To Restart Browser

Some browsers require restart after certificate installation.

Thinking HTTPS Is Broken

HTTPS is working perfectly.

The browser is protecting you from an untrusted intermediary.

That's exactly what it's supposed to do.

What Security Researchers Learn Here

This chapter teaches something much bigger than Burp.

It teaches how HTTPS trust actually works.

Most internet users never think about certificates.

Security professionals think about them constantly.

Because every secure website depends on them.

Key Takeaways

✓ HTTPS encrypts communication between browsers and websites

✓ Burp sits in the middle of that communication

✓ Browsers do not automatically trust Burp

✓ Burp uses its own Certificate Authority

✓ Installing the Burp certificate creates trust

✓ Once trusted, Burp can inspect HTTPS traffic

✓ Certificate errors are usually a sign that security is working correctly

✓ Understanding certificates is a foundational web security skill

What's Next?

Now that Burp can successfully inspect encrypted traffic, it's time to start capturing real requests.

In the next chapter, we'll enable interception, capture our first request, and learn how to pause web traffic before it reaches the server.

Top comments (0)