0

I'm using BURP and I always get this alert after a while (maybe like 2-3 minutes of use)

javax.net.ssl.SSLHandshakeException: server certificate change is restrictedduring renegotiation

any idea where that could come from? I don't see anyone talking about it on internet

David 天宇 Wong
  • 3,724
  • 4
  • 35
  • 47

2 Answers2

3

You're having the exact same issue that has been asked previously: What means "javax.net.ssl.SSLHandshakeException: server certificate change is restrictedduring renegotiation" and how to prevent it?

In short the issue is due to security controls in the newer Java versions that check whether the certificate that it received for the hostname has the same contents (Subject, Issuer, SANs) as the one it previously received.

Community
  • 1
  • 1
Chris
  • 81
  • 1
  • 5
0

This has to do with newer versions of Java with older versions (or the free version) of Burp Suite, and using an upstream proxy. Burp Suite Pro v1.6.07+ fixes this, as well as turning off the upstream proxy or downgrading your Java (though not recommended).

Hacksonville
  • 1