HTTPS connections over proxy servers

TLS/SSL (The S in HTTPS) guarantees that there are no eavesdroppers between you and the server you are contacting, i.e. no proxies. Normally, you use CONNECT to open up a TCP connection through the proxy. In this case, the proxy will not be able to cache, read, or modify any requests/responses, and therefore be rather useless.

If you want the proxy to be able to read information, you can take the following approach:

  1. Client starts HTTPS session
  2. Proxy transparently intercepts the connection and returns an ad-hoc generated(possibly weak) certificate Ka, signed by a certificate authority that is unconditionally trusted by the client.
  3. Proxy starts HTTPS session to target
  4. Proxy verifies integrity of SSL certificate; displays error if the cert is not valid.
  5. Proxy streams content, decrypts it and re-encrypts it with Ka
  6. Client displays stuff

An example is Squid’s SSL bump. Similarly, burp can be configured to do this. This has also been used in a less-benign context by an Egyptian ISP.

Note that modern websites and browsers can employ HPKP or built-in certificate pins which defeat this approach.

Related Posts:

  1. How do I pull from a Git repository through an HTTP proxy?
  2. ndroid 8: Cleartext HTTP traffic not permitted
  3. Why am I suddenly getting a “Blocked loading mixed active content” issue in Firefox?
  4. WordPress behind Proxy – Mixed Content
  5. Mixed Content with SSL, wordpress behind a reverse proxy
  6. Infinite loop behind SSL proxy on non-standard port
  7. how to server over http and https with one installation
  8. What is the difference between a URI, a URL and a URN?
  9. How can I make git accept a self signed certificate?
  10. Problem HTTP error 403 in Python 3 Web Scraping
  11. Is 418 “I’m a teapot” really an HTTP response code?
  12. nodejs – error self signed certificate in certificate chain
  13. What’s the difference between using application/csv vs text/csv? [duplicate]
  14. Java: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  15. What are all the possible values for HTTP “Content-Type” header?
  16. Ngrok errors ‘502 bad gateway’
  17. Could not establish secure channel for SSL/TLS with authority ‘*’
  18. Are HTTP headers case-sensitive?
  19. How to find out if you’re using HTTPS without $_SERVER[‘HTTPS’]
  20. How to force Laravel Project to use HTTPS for all routes?
  21. How can I fix the “No certificates found – The app Chrome has requested a certificate” Android / Google Chrome issue
  22. bower proxy configuration
  23. Hiding WordPress REST API v2 endpoints from public viewing
  24. SSL Breaks WordPress CSS
  25. Possible to fix admin URL behind proxy issue without hacking core?
  26. Stop WordPress from using HTTPS and just use HTTP
  27. Chrome Version 44.0.2403.89 m is trying to force HTTPS
  28. HTTPS leads to Sorry, you are not allowed to access this page
  29. Is the WordPress HTTPS Plugin Still Safe To Use? [closed]
  30. Force home page to be https?
  31. Redirect www to non-www htaccess
  32. Admin-Ajax.php, SSL, Non-SSL
  33. How disable SSL redirect for specific URL?
  34. How are both HTTP and HTTPS versions displaying?
  35. How can I change permalinks to use a different domain and path from where the blog is hosted?
  36. HTTPS page link in menu
  37. SSL setup: wp-login css doesn’t load over httpS
  38. get_permalink executes link without https
  39. How to modify the .htaccess to force ssl on login and admin pages
  40. 302 redirect to signup with nginx reverse proxy
  41. Outgoing proxy connection problem
  42. wp-admin redirect loop with ssl
  43. wordpress multisite, https for whole site or just admin?
  44. Subdirectory multisite installation with several domain names?
  45. Access general settings trough wordpress files
  46. Redirect HTTP to HTTPS
  47. WordPress : To load all asset files coming from HTTP to HTTPS?
  48. Transfer to HTTPS – mixed content on main page only [closed]
  49. Link to Network Admin Broken After Switching to HTTPS
  50. Adding a SSL Certificate
  51. Chrome 83 doesn’t connect WP login page after update from http to https on localhost
  52. multisite subdomain behind reverse proxy
  53. WordPress links https overwrite issue
  54. How can I fix the mixed content problems of the kk star ratings plugin?
  55. How to fix mixed content warnings for plugin resources?
  56. Changing HTTP to HTTPS
  57. Mixed Content warnings google fonts
  58. Why is wordpress forcing https link generation?
  59. Hi do I change Media files that still show as http after installing ssl
  60. WordPress address URL and bloginfo
  61. How to be sure to get last page version without ANY cache?
  62. My site doesn’t redirect from HTTP to HTTPS
  63. How does WordPress format the url on a 301 when a trailing slash is missing?
  64. Category links break the https
  65. force https except one page/post
  66. Only execute function if SSL is set up properly
  67. Admin sometimes redirects to HTTPS
  68. HTTPS connection with wampserver for “Facebook for WordPress” plugin
  69. https and wordpress breaks posts
  70. Why is ajax working on one server and not the next?
  71. How can I rewrite old attachment URLs?
  72. Can’t access wp-admin after http to https change
  73. Trying to Decide Between Reverse-proxy and Multisite
  74. Broken css on mobile phones only on https
  75. No https in url when writing links like:
  76. Get “HTTP/1.1 406 Not Acceptable” when accesing my website with Delphi Indy Control
  77. Redirecting specific sites to HTTP in WordPress Multisite
  78. Bedrock Boilerplate under a sub-directory and access through a reverse proxy setup
  79. 404 on pretty permalinks when serving via HTTPS
  80. Mixed Content: The page at ” was loaded over HTTPS, but requested an insecure font ”
  81. WordPress site not forcing from http to https instead getting redirected too many times
  82. Implications of not completing all tasks when switching to HTTPS
  83. Redirect HTTP request to HTTPS request
  84. How to force the admin-ajax.php file to load over HTTPS?
  85. 404 Page not found error after adding ‘s’ in ‘http’ in Settings
  86. WordPress HTTP 500 Error “page isn’t working”
  87. How to detect if an other front-end post/page is in HTTPS/SSL from admin to display a notice?
  88. How come all my http URLs are turned to https?
  89. Moving site from HTTP to HTTPS
  90. WordPress keeps redirecting to an unsecure connection?
  91. How to move a https website back to dev and access the admin?
  92. installed WordPress but can’t upgrade or add plugins due to webdav https?
  93. Duplicator live to wamp https to http
  94. Page permalinks are http but show up as https?
  95. Whole website redirected to httpa but in dashboard settings still http
  96. After migration works only first page
  97. Is it bad to redirect http to https?
  98. For what is the “.well-known”-folder?
  99. Nginx Redirect via Proxy, Rewrite and Preserve URL
  100. Human readable format for http headers with tcpdump

Leave a Comment

error code: 523