up vote 0 down vote favorite
share [g+] share [fb]

I am having troubles with some testing that we are performing. We have the following layout for our network. We have clients attached behind a proxy server. All traffic from these clients is required to go through this network proxy before being transported out of this network segment on to their destination. In our case we would have a set of internal web servers on the outside interface of the proxy server. Our clients would request a website from one of our internal servers that is on the other side of the proxy server with their request first passing through this proxy. The problem that we run into deals with HTTPS/SSL traffic that is hosted on this web server. The SSL traffic is broken and not allowed to work when forced through the proxy. I am not for sure the exact reason this is happening and was curious if someone could help provide some insight into this issue for me and how it could possibly be corrected.

link|improve this question
71% accept rate
SSL via a proxy should be even simpler than HTTP - the client just tells the proxy it wants to CONNECT and then the proxy relays the relevant data. Can you connect to the HTTPS server using a browser on the proxy? What proxy software are you using? – symcbean Nov 17 '10 at 15:43
feedback

1 Answer

up vote 0 down vote accepted

How are you forcing SSL through the proxy? If you are doing it with firewall/nat hacks (transparent/interception) then it won't work. The clients MUST be configured to use the proxy, or you must do soem really wacky things with certificates.

link|improve this answer
What would be some examples of the wacky things that one would need to do. We have an ACL that denies internal users from accessing outside IP address space and the only IP allowed to access port 80 and 443 would be from the proxy server. – John Nov 17 '10 at 18:31
For a transparent HTTPS proxy, your proxy basically has to perform a man-in-the-middle exploit against the https session. faqs.org/docs/Linux-mini/TransparentProxy.html#ss2.3 stackoverflow.com/questions/2017556/filtering-https-traffic – Zoredache Nov 17 '10 at 20:58
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.