Help in deciphering contents of intercepted file requested by Kindle

[xyrompec]

Hi, community!

With some help of the Kindle Store Proxy (especially this file), I was able to connect my Kindle Oasis (with 5.13.3) to a mitmproxy running on my Mac, deciphering even the HTTPS requests.

There were some interesting findings, such as the kindle POSTing to https://softwareupdates.amazon.com/software/inventory2 to check for updates.

While analyzing requests, I found one URL that was puzzling:

https://d18os95hu8sz6h.cloudfront.net/1/LATEST

The Kindle makes this request not very often, usually just right after startup.

The URL is also not user-specific (meaning that the Kindle doesn't POST any serial-related data) and I could download the file directly from my computer. I attached the file below to see if anyone can help decipher what the file is about. I also saved the file on the internet archive.

Edit #1: Add attachment. Ignore .txt extension at the end. Firefox seems to think that it's a .dms file.

[irreld]

It's a cname for prod.amazoncrl.com . So no mystery stuff here.

I think if you post some other requests captured that would be more interesting

[DNSB]

Originally Posted by xyrompec

Edit #1: Add attachment. Ignore .txt extension at the end. Firefox seems to think that it's a .dms file.

Looking at the first 3 bytes of the file, the CRL found there suggests that it is a certificate revocation list.

[xyrompec]

Originally Posted by irreld

It's a cname for prod.amazoncrl.com . So no mystery stuff here.

I think if you post some other requests captured that would be more interesting

Sure, I've captured everything since the device was first set up and registered. What would be of interest?

[xyrompec]

Originally Posted by DNSB

Looking at the first 3 bytes of the file, the CRL found there suggests that it is a certificate revocation list.

Thanks! So seems like it's fine to let the request pass through. I had guessed it was something related to certificates by "x-kn-appID" of the request header:

GET https://52.84.169.98/1/LATEST                                                                

Host:           d18os95hu8sz6h.cloudfront.net                                                                                             
Accept:         */*                                                                                                                       
If-None-Match:  "59f07dfa6a5832524de100f2f0118308"                                                                                        
x-kn-appID:     KINDLEAPP:com.lab126.certmand