I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am trying to reverse engineer an apk that I obtained. I have performed my usual static analysis of the apk, but I also want to dynamically analyze the HTTPS traffic. I am running an emulated Pixel 2 device with API 23 (Marshmallow).
I have read all the documentation I can find regarding how to use the Charles proxy as an TLS proxy for Android. However, much of the documentation is directed at setting up a TLS proxy for an app for which I have control over the AndroidManifest.xml and can thus set the network security configuration to trust user CAs--the default/documented procedure to setup a Charles TLS proxy involves downloading the Charles CA cert to the Android device and installing it as a user CA.
I assumed that if I could force the charles CA cert into the System cert folder (as opposed to the user certs) then the TLS proxy would "just work." However, even after I copied the Charles CA cert into the "/system/etc/security/cacerts" directory I still can not MiTM HTTPS traffic for apps. In addition, when I try to MiTM web browser traffic, the browser still claims there is an issues with the TLS connection (even thought the Charles cert is in the cacerts folder and should now be trusted). I confirmed the Charles cert is listed in the list of "System" CA certificate (although the settings app does crash if I try to view the cert metadata info--because there is none for that cert, just the encoded certificate).
Why is the Charles CA cert not trusted even when I have forced it into the system CA cert folder? Is there a better tool to be using besides Charles? Any help would be greatly appreciated as I am coming to my wits' end.