I'm firstly gonna summerize my goal:

I'll setup a DNS server and configure my smart tv to use it. I'll set the DNS server up so that requests to specific DNS zones will not actually be resolved, rather the DNS server will return the IP of my proxy server. The proxy server needs to accept any HTTPS request, inspect the SNI, and forward the request to the corresponding host. I cannot statically configure the hosts to which the proxy shall pass the incoming requests, as those hostnames are being "randomly" (= outside of my control) generated in a specific DNS zone.

So far I've looked into nginx's ngx_stream_ssl_preread_module, as well as into HProxy. So far, I have not found a way to make them proxy pass the traffic to $requesthostname, it seems like you always need to specify backends to which you pass the traffic.

While inspecting HTTPS traffic on my local machine using mitmproxy, I realized that it behaves as I desire, in that it forwards all HTTPS requests to the corresponding hostnames. However, as I cannot install mitmproxy's CA certificate on my smart tv, I cannot use it for this purpose.

Does anybody know a proxy software that serves my purpose, or a way to configure one of the proxyservers I mentioned in such a way that it behaves in such a manner?

Help is greatly appreciated, thanks in advance

  • Any particular reason why you are modifying DNS returns, rather than inserting the proxy as the client's next hop router? Jun 21 '20 at 15:09
  • 1. I cannot change the clients gateway, nor modify anything regarding its routing 2. The proxy server is 6000 miles away, I don't want to have all traffic be slowed down because it has to go such a far way Jun 21 '20 at 15:22
  • Your goal, whatever it is, is completely off topic here.
    – Massimo
    Jun 21 '20 at 17:07

It seems like this should be dead simple in nginx.

stream {
    server {
        proxy_pass $ssl_preread_server_name:443;
  • Doing it like this, in the HTTP section, doesn't pass through the SSL traffic correctly/unmodified, leading to ERR_SSL_PROTOCOL_ERROR. The only way to achieve SSL passthrough in nginx is, I think, to proxy pass the TCP traffic in the stream block of the nginx configuration. Jun 21 '20 at 15:17
  • 1
    Oh right, it does need to be a stream. Jun 21 '20 at 15:19
  • Configuring the stream as shown in your answer leads to ERR_CONNECTION_CLOSED. When the backend is explicitely defined, it does work though. edit: nginx error logs say: no resolver defined to resolve the domain edit2: specifying the resolver seems to have done the trick Jun 21 '20 at 15:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.