Troubleshooting

Troubleshooting certificates issues

Is good to carefully read the oficial documentation and undertand how the certificates process works.

http://burp.grke.org/docs/burp_ca.html

1) The server doesn't generate the certificates required in CA folder.

If for some reason you have manually created the /etc/burp/CA dir, just do it:

    rm -r /etc/burp/CA

Generate new ca certs for server

    # Stop server
    service burp-server stop 
    # Generate new cert and exit
    burp -g -c /etc/burp/burp-server.conf -F
    # Start server ...

Explained:

When the server starts, the ca_conf file will be read, and the CA_DIR value from that file will be read. If the CA_DIR directory already exists, the automatic CA setup finishes here.

2) Client for monitor doesn't see more than one client (itself)

Normally client used to monitor all clients, configured on /etc/burp/burp.conf or in /etc/burp/monitor.conf.

Add client as restore_client in burp-server.conf, like:

    restore_client monitor

where 'monitor' is the name of the client defined in monitor.conf for example (line name = monitor)

3) Client certs could not be signed, got error similar to "No such file or directory"

Error similar to:

~  burp -a m
{ "logline": "Could not find ssl_cert /etc/burp/ssl_cert-burp-ui.pem: No such file or directory" }
{ "logline": "Could not find ssl_key /etc/burp/ssl_cert-burp-ui.key: No such file or directory" }
{ "logline": "Could not find ssl_cert_ca /etc/burp/ssl_cert_caèburp-ui.pem: No such file or directory" }
{ "logline": "auth ok" }
{ "logline": "Server version: 2.0.52" }
{ "logline": "Server will sign a certificate request" }
{ "logline": "Generating SSL key and certificate signing request" }
{ "logline": "Running '/usr/sbin/burp_ca --key --keypath /etc/burp/ssl_cert-burp-ui.key --request --requestpath /etc/burp/CA-client/burp-ui.csr --name burp-ui'" }
generating key burp-ui: /etc/burp/ssl_cert-burp-ui.key
Generating RSA private key, 2048 bit long modulus
........+++
..+++
e is 65537 (0x10001)
generating request burp-ui
/etc/burp/CA-client/burp-ui.csr: No such file or directory
3070026960:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/etc/burp/CA-client/burp-ui.csr','w')
3070026960:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
{ "logline": "/usr/sbin/burp_ca returned: 0" }
{ "logline": "could not open /etc/burp/CA-client/burp-ui.csr: No such file or directory" }
{ "logline": "Error with cert signing request" }

By mistake, in some cases people confuses the usage of ssl files and if for some reason some of these files are the same for client and server running on the same system, server or client could overwrite some of these files.

Is better to have different files for ssl files on burp-server.conf (good file):

    # SSL certificate authority - different file on both server and client
    ssl_cert_ca = /etc/burp/ssl_cert_ca.pem

    # Server SSL certificate
    ssl_cert = /etc/burp/ssl_cert-server.pem

    # Server SSL key
    ssl_key = /etc/burp/ssl_cert-server.key

On client, ej: burp.conf (good file)

    name = burp-ui
    # SSL certificate authority - diferent file on both server and client
    ssl_cert_ca = /etc/burp/ssl_cert_ca-burp-ui.pem
    # Client SSL certificate
    ssl_cert = /etc/burp/ssl_cert-burp-ui.pem
    # Client SSL key
    ssl_key = /etc/burp/ssl_cert-burp-ui.key
    # SSL key password
    ssl_key_password = password

You can confirm if those were really overwritten, if you see different dates on those files for the server, ej:

    -rw-r--r-- 1 root root 1131 janv.  1  1970 ssl_cert_ca.pem
    lrwxrwxrwx 1 root root   27 déc.   8 23:05 ssl_cert-server.key -> /etc/burp/CA/burpserver.key
    lrwxrwxrwx 1 root root   27 déc.   8 23:05 ssl_cert-server.pem -> /etc/burp/CA/burpserver.crt

Possible conclusion is: the server CA is broken, you need to repair it:

Try to delete these files: (backup all /etc/burp first)

    rm /etc/burp/ssl_cert-server.pem /etc/burp/CA/burpserver.crt /etc/burp/ssl_cert_ca.pem rm /etc/bup/ssl_cert-server.pem /etc/burp/CA/burpserver.crt

    rm -r /etc/burp/CA

Generate new cert for server

    # Stop server
    service burp-server stop 
    # Generate new cert and exit
    burp -g -c /etc/burp/burp-server.conf -F
    # Start server ...

You will need to remove the certs files on other clients too, so they will request new certs to server.

More details are explained at:

https://github.com/grke/burp/issues/519#issuecomment-266063355

4) Clients certs not valid after reinstall client

When you reinstall a client, the server certs of previous signing are still on burp server, but new installation has no certs, so server doesn't validate the certs.

One solution is to clean the old client certs on burp server:

sudo rm /etc/burp/CA/clientname.c*

Another solution is to get old client certs from backup, see Recreation of burp client...