2

A client software version uses TLS 1.0 protocol to connect to a web service (the current version can't be configured to use a more recent protocol version just yet), and the server policy was recently upgraded to allow only TLS 1.2.

Is it possible to create a proxy server, which would accept TLS 1.0 connections, and work through a TLS 1.2 connection downstream?

That would solve a problem temporary, until the client software upgraded.

What software could be used to create such proxy server?

1

Yes this can be done. If the protocol is HTTPS you could use a variety of software like Fiddler, mitmproxy or even squid which have this feature for TLS interception and analysis. Also various firewalls have such feature for this purpose. You could also use socat to work as TLS server on one side and TLS client. But in all these cases the original certificate is lost and a new one used and not all of these solutions properly check the original certificate.

0

I've successfully done the setup with mitmproxy in reverse proxy mode:

https://mitmproxy.readthedocs.io/en/v2.0.2/features/reverseproxy.html.

Please note, you will need your webservice's certificate PEM (that includes certificate and private key) in order the proxy be able to do encryption-decryption-signing transparently for your client's software and system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.