I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is available only through the "secure browser" as the website is hosted on an internal IP and the secure browser works as a "per app VPN" meaning that the traffic from the browser is tunneled directly to the internal network. The tunneling is secured by a client certificate installed on the Android and iOS devices. I cannot root or jailbreak the devices.
Currently I have set up a wireless hotspot and the proxy settings on the mobile devices are set to connect to Burp on my computer. I am able to intercept all other traffic that is not going through the secure browser. However, the data going through the secure browser is not intercepted. It seems as if the connection is tunneled before relaying to Burp.
Is there any way I can intercept the communication with Burp without the client certificate?