Is it possible to have HTTPS connections over proxy servers? If yes, what kind of proxy server allows this?
A:
TLS/SSL (The S in HTTPS) guarantees that there are no eavesdroppers between you and the server you are contacting, i.e. no proxies. Nevertheless, you could use the following hack:
- Client starts HTTPS session
- Proxy intercepts the call and returns an ad-hoc generated(possibly weak) certificate Ka, signed by a certificate authority that is unconditionally trusted by the client.
- Proxy starts HTTPS session to target
- Proxy verifies integrity of SSL certificate; displays error if the cert is not valid.
- Proxy streams content, decrypts it and re-encrypts it with Ka
- Client displays stuff
I think I heard of a solution implementing this. Unfortunately, I can't remember its name.
phihag
2009-02-05 15:34:49
This could work in principle, but that's not the way browsers talk to HTTP proxies for HTTPS requests. The way it's described here implies that the proxy server is effectively a Man-In-The-Middle (so would have to be trusted accordingly).
Bruno
2010-07-06 12:32:30
http://www.oxid.it/cain.html
George Tsiokos
2010-07-06 21:04:10
+1
A:
as far as i can remember, you need to use a HTTP CONNECT query on the proxy. this will the convert the request connection to a transparent TCP/IP tunnel.
so you need to know if the proxy server you use support this protocol.
chburd
2009-02-05 15:56:07
Indeed, clients use the CONNECT verb to use https:// URIs via HTTP proxy servers. In this case, the connection is tunnelled through the proxy, so the certificate verification is done as usual, as if the client was talking directly to the end server.
Bruno
2010-07-06 12:30:52
A:
What if we assume that the client doesn't validate the proxy's certificate? (He only trusts the server's certificate). Is it possible then to communicate with the server on https if the client has a valid proxy set?
You should've edited your question. By answering, nobody saw it. Answer's yes.
phihag
2009-03-27 01:11:27
A:
If it's still of interest, here is an answer to a similar question: http://stackoverflow.com/questions/3118602/convert-http-proxy-to-https-proxy-in-twisted/3186044#3186044
To answer the second part of the question:
If yes, what kind of proxy server allows this?
Out of the box, most proxy servers will be configured to allow HTTPS connections only to port 443, so https URIs with custom ports wouldn't work. This is generally configurable, depending on the proxy server. Squid and TinyProxy support this, for example.
Bruno
2010-07-06 12:35:02