HTTPS connections over proxy servers

by

TLS/SSL (The S in HTTPS) guarantees that there are no eavesdroppers between you and the server you are contacting, i.e. no proxies. Normally, you use CONNECT to open up a TCP connection through the proxy. In this case, the proxy will not be able to cache, read, or modify any requests/responses, and therefore be rather useless.

If you want the proxy to be able to read information, you can take the following approach:

  1. Client starts HTTPS session
  2. Proxy transparently intercepts the connection and
    returns an ad-hoc generated(possibly
    weak) certificate Ka,
    signed by a certificate authority
    that is unconditionally trusted by
    the client.
  3. Proxy starts HTTPS session to target
  4. Proxy verifies integrity of SSL
    certificate; displays error if the
    cert is not valid.
  5. Proxy streams content, decrypts it
    and re-encrypts it with
    Ka
  6. Client displays stuff

An example is Squid’s SSL bump. Similarly, burp can be configured to do this. This has also been used in a less-benign context by an Egyptian ISP.

Note that modern websites and browsers can employ HPKP or built-in certificate pins which defeat this approach.

More Related Contents:

  1. Cannot download Docker images behind a proxy
  2. What’s the difference between a proxy server and a reverse proxy server? [closed]
  3. How to fill in proxy information in cntlm config file?
  4. Bower calls blocked by corporate proxy
  5. How do you detect a VPN or Proxy connection? [closed]
  6. HTTPS Proxy Server in node.js
  7. Unable to tunnel through proxy. Proxy returns “HTTP/1.1 407” via https
  8. Run redis in marathon (mesos) under one url
  9. Dynamic proxy_pass to $var with nginx 1.0
  10. How can I make git accept a self signed certificate?
  11. Allowing Java to use an untrusted certificate for SSL/HTTPS connection
  12. Why is Proxy to a Map object in ES2015 not working
  13. performing HTTP requests with cURL (using PROXY)
  14. Disable certificate verification in PHP SoapClient
  15. Proxy with express.js
  16. Making a HTTPS request using Android Volley
  17. How to run ‘dotnet dev-certs https –trust’?
  18. https URL with token parameter : how secure is it?
  19. Access Https Rest Service using Spring RestTemplate
  20. How to do an HTTPS POST from Android?
  21. SSL Error: unable to get local issuer certificate
  22. How to use bundler behind a proxy?
  23. Correctly switching between HTTP and HTTPS using .htaccess
  24. How to preserve request url with nginx proxy_pass
  25. R: Calculate cosine distance from a term-document matrix with tm and proxy
  26. Debugging failing HTTPS WebRequest
  27. javax.net.ssl.sslpeerunverifiedexception no peer certificate
  28. Return a requests.Response object from Flask
  29. How can I have CodeIgniter load specific pages using SSL?
  30. How can I make Android Volley perform HTTPS request, using a certificate self-signed by an Unknown CA?

Leave a Comment