We have access to a remote web API that requires a client cert to access (it's a PKI). I want to allow access to this API for specific servers / IPs in our network without them having to import the client cert into the keystore and also enable them to use http and not https. We cannot use a reverse proxy approach for a couple of reasons I would rather not get into.
Is there any way to talk http from client to proxy and from there use https (with the client-cert) to the server? I have seen ways to achieve this in squid using SslBump but only when https is being used from the client. I have seen a few questions like this for Apache but they all use ProxyPass which according to here Apache Module mod_proxy | apache.org is only for reverse-proxying.
Client is configured to use proxy
mylocalproxy:8999and calls http://pki.globalpki123.com/rest/
Proxy mylocalproxy connects to https://pki.globalpki123.com/rest/ and presents client cert.
I am open to using squid, apache or any web server that provides real forward proxy capabilities.