I'm looking for a local HTTP proxy which I can run locally on my machine. This proxy accepts HTTP and HTTPS request and passes them upstream on to an external corporate proxy. The local proxy needs to fulfill the following requirements:

  • 1: Needs to be a Java program which I can run on a dedicated JVM.
  • 2: The proxy needs to be able to authenticate upstream via NTLM. (Credentials stored somewhere in the local proxy.)


  • 3: Passes HTTPS requests transparently through, so that the certificates come from the original issuer.

I have tried Zed Attack Proxy, and it does 1 and 2, but not the bonus requirement 3. Also, with ZAP Proxy I have huge reliability troubles.

What is a good other reliable Java proxy for this task?

closed as off-topic by MadHatter, Rob Moir, Greg Askew, Jenny D, mdpc Feb 13 '16 at 1:30

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Why does it need to be a Java program / why does it have be run on the dedicated JVM ? – Lawrence Mar 26 '14 at 7:19
  • For some group policy reasons, on that particular machine I can only use network connections from Java apps, not from other executables. – halloleo Mar 26 '14 at 9:01
  • How about a 'windows service' ? – Lawrence Mar 26 '14 at 13:27
  • A Windows service were fine, if the networking part sat on top of the JVM. - Not sure whether this is possible in Windows. Anyway, I'm sure the easiest is a pure Java proxy (like ZAP), just more reliable and preferably with certificate pass-through (no request inspection for HTTPS). – halloleo Mar 27 '14 at 7:12
  • I was thinking cntlm, but I don't think it satisfies your requirements. – Lawrence Mar 27 '14 at 7:56

Quite simply not possible. Authenticating would involve reading what the user says. Passing the original certificates from the original issue makes this impossible. This is the entire purpose of HTTPS

  • Do you mean a proxy cannot transparently pass through HTTPS requests ? – Lawrence Mar 26 '14 at 7:41
  • The next proxy in the chain, the corporate proxy, can do it: You can send it a HTTPS request and check the certificate of the certificate which comes back: The certificate is issued by the destination website, not by the proxy. – halloleo Mar 26 '14 at 9:04

I created this Java proxy some time ago using Java AIO: http://apetrelli.github.io/scafa/

Currently it can use NTLM proxies, no authentication proxies and direct connection.

It is an unfinished work, it uses a lot of memory (160 MB in Linux) and the docs need refreshing.

Not the answer you're looking for? Browse other questions tagged or ask your own question.