ChatGPT macOS Native App[old]

ChatGPT macOS Native App

Note: This step is only required if you are using a SASE-based deployment. If you are using the Lumia installers, no additional steps are needed to analyze the ChatGPT native app.
On macOS, the native ChatGPT application uses certificate pinning, which prevents it from working with TLS inspection and results in an error message when started.
notion image
To mitigate this, you need to add a local configuration that allows the root CA used for SSL inspection. This setting only needs to be configured once per machine, in the user’s context (not sudo).
To generate the required command, download the LumiaBypassChatGPTPinning.sh macOS shell script (right-click → “Save As…”), save it to your computer, make it executable (chmod +x), and then run it.
The script takes as input the root certificate used by your SASE:
lumia@Mac % ./LumiaBypassChatGPTPinning.sh cert.pem 

To allow Lumia to inspect the ChatGPT macOS app, run the following command (once) on the local machine:

defaults write com.openai.chat com.openai.pinned_cert_hash_list -array "tNHFJdNyoIVDEBYsLeGwW0AV4eBZnio2k3qVx0uLeEM="
If you see a zsh: permission denied error, it means the script is not executable. Run this to fix:
lumia@Mac % chmod +x ./LumiaBypassChatGPTPinning.sh
Please make sure you’re using the latest version of the ChatGPT macOS app.
Where to find my SASE root certificate?
If you don’t have your SASE root certificate, you can extract it from your browser. Open any URL that is being TLS/SSL-inspected by your SASE, then extract the topmost certificate in the list.
notion image
For Cloudflare, the certificate is usually already available as a file at /Library/Application Support/Cloudflare/installed_cert.pem
For any question, contact us at support@lumia.security.