Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a transparent proxy setup in Ubuntu 10.04.4 with firehol and tinyproxy that works fine for http but I can't get it to work for https.

Connecting to tinyproxy directly works fine as the following commands complete ok:

env  http_proxy=localhost:8888 curl
env https_proxy=localhost:8888 curl

Http transparent proxying also works fine:


but when accessing google directly using https, the command just hangs:


Here are the complete config files for firehol and tinyproxy. Note that I have no interest in using firehol for anything but transparent proxying.


transparent_proxy "80 443" 8888 proxy
interface any world
   client all accept
   server all accept

tinyproxy.conf (all defaults except upstream proxy):

User    nobody
Group   nogroup
Port    8888
Timeout 600
DefaultErrorFile  "/usr/share/tinyproxy/default.html"
StatFile          "/usr/share/tinyproxy/stats.html"
Logfile           "/var/log/tinyproxy/tinyproxy.log"
LogLevel Info
PidFile           "/var/run/tinyproxy/"
MaxClients     100
MinSpareServers  5
MaxSpareServers 20
StartServers    10
MaxRequestsPerChild 0
ViaProxyName "tinyproxy"
ConnectPort 443
ConnectPort 563
share|improve this question
up vote 7 down vote accepted

As far as I can tell tinyproxy simply does not support incoming HTTPS connections. It will permit you to access HTTPS sites by using the CONNECT method, but for that to be used, the browser/client must know that it is talking to a proxy server, and use the correct connection methods.

The ConnectPort directives simply defines which ports it is permissible to make connections to.

The only FOSS product that supports transparently proxying HTTPS connection is Squid, and the support for that is relatively recent. In also introduces some pretty major security concerns since a transparent HTTPS proxy has to perform a man-in-the-middle attack and decrypt the connection so that it knows what to connect to.

share|improve this answer
That makes sense. After investigating, it appears that you are correct and squid is the way to go. There is no backport of 3.1 with ssl/https support available for Ubuntu 10.04 (lucid) so custom compile is required. I'll try this out. Thanks! – Stefan Farestam Nov 10 '12 at 19:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.