Hi all,
We are currently using an explicit forward proxy using HTTP basic auth. The goal is to at least secure the transmitted credentials.
What we had set up before:
- client —– http —–> proxysg:80 —-> http://internet.site/…
- client —– http —–> proxysg:80 —-> https://internet.site/… (uses HTTP CONNECT)
What we would like to do now is the same as above, except the first step which should preferably become https:
- client —– https —–> proxysg:443 —-> http://internet.site/…
- client —– https —–> proxysg:443 —-> https://internet.site/…
That last part required setting up a proxy service listening on proxysg:443 and selecting “HTTPS reverse proxy”. I hope that is correct!
Currently accessing a site using HTTP on the internet works:
# curl -vv --proxy https://192.168.1.12:443 --proxy-insecure --insecure http://www.site.com/
* Trying 192.168.1.12...
* TCP_NODELAY set
* Connected to 192.168.1.12 (192.168.1.12) port 443 (#0)
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Proxy certificate:
* subject: C=US; ST=CA; O=Blue Coat Systems, Inc.; OU=Blue Coat SG-S200 Series; CN=xxx
* start date: Jan 1 10:46:49 2020 GMT
* expire date: Jan 1 10:46:49 2025 GMT
* issuer: C=US; ST=California; L=Sunnyvale; O=Blue Coat Systems, Inc.; OU=Blue Coat, ABRCA; CN=abrca.bluecoat.com; emailAddress=sysadmin@bluecoat.com
* SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
> GET http://www.site.com/ HTTP/1.1
> Host: www.site.com
> User-Agent: curl/7.60.0
> Accept: */*
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 OK
< Server: nginx/1.10.3
< Date: Wed, 29 Jan 2020 15:46:24 GMT
< Content-Type: text/html
< Content-Length: 226
< Last-Modified: Mon, 22 Sep 2014 17:55:21 GMT
< ETag: "e2-503ab2786f440"
< Accept-Ranges: bytes
< Vary: Accept-Encoding
< Proxy-Connection: Keep-Alive
< Connection: Keep-Alive
< Age: 0
<
<HTML>
<HEAD>
<TITLE>Welcome!</TITLE>
Accessing a site using HTTPS does NOT work, however I don’t understand why. It shouldn’t depend on the outer layer of the connection which has now become HTTPs instaead of HTTP…
# curl -vv --proxy https://192.168.1.12:443 --proxy-insecure --insecure https://www.site.com/
* Trying 192.168.1.12...
* TCP_NODELAY set
* Connected to 192.168.1.12 (192.168.1.12) port 443 (#0)
* ALPN, offering http/1.1
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Proxy certificate:
* subject: C=US; ST=CA; O=Blue Coat Systems, Inc.; OU=Blue Coat SG-S200 Series; CN=xxx
* start date: Jan 1 10:46:49 2020 GMT
* expire date: Jan 1 10:46:49 2025 GMT
* issuer: C=US; ST=California; L=Sunnyvale; O=Blue Coat Systems, Inc.; OU=Blue Coat, ABRCA; CN=abrca.bluecoat.com; emailAddress=sysadmin@bluecoat.com
* SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
* allocate connect buffer!
* Establish HTTP proxy tunnel to www.site.com:443
> CONNECT www.site.com:443 HTTP/1.1
> Host: www.site.com:443
> User-Agent: curl/7.60.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
<
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to www.site.com:443
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, Client hello (1):
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to www.site.com:443
The remote end shows this (no data is transmitted)
98 16:47:41.913409959 1.1.1.1 → 2.2.2.2 TCP 74 53656 → 443 [SYN] Seq=0 Win=65535 Len=0 MSS=1380 SACK_PERM=1 TSval=4144667785 TSecr=0 WS=64
99 16:47:41.913463623 2.2.2.2 → 1.1.1.1 TCP 74 443 → 53656 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 SACK_PERM=1 TSval=3089349285 TSecr=4144667785 WS=128
100 16:47:41.925293814 1.1.1.1 → 2.2.2.2 TCP 66 53656 → 443 [ACK] Seq=1 Ack=1 Win=262848 Len=0 TSval=4144667797 TSecr=3089349285
101 16:47:41.925490666 1.1.1.1 → 2.2.2.2 TCP 66 53656 → 443 [FIN, ACK] Seq=1 Ack=1 Win=262848 Len=0 TSval=4144667797 TSecr=3089349285
102 16:47:41.925529264 2.2.2.2 → 1.1.1.1 TCP 66 443 → 53656 [FIN, ACK] Seq=1 Ack=2 Win=29056 Len=0 TSval=3089349288 TSecr=4144667797
103 16:47:41.937479029 1.1.1.1 → 2.2.2.2 TCP 66 53656 → 443 [ACK] Seq=2 Ack=2 Win=262848 Len=0 TSval=4144667809 TSecr=3089349288
Proxy Policy trace is inconclusive:
connection: service.name=Explicit HTTPS client.address=192.168.2.226 proxy.port=443 client.interface=0:0.44 routing-domain=default
location-id=0 access_type=unknown
time: 2020-01-29 15:19:07 UTC
CONNECT tcp://www.site.com:443/
DNS lookup was unrestricted
User-Agent: curl/7.60.0
user: unauthenticated
authentication status='not_attempted' authorization status='not_attempted'
url.category: none@Policy;none@Blue Coat
total categorization time: 0
static categorization time: 0
server.response.code: 0
client.response.code: 200
application.name: none
application.operation: none
application.group: none
DSCP client outbound: 65
DSCP server outbound: 65
What could be the problem?
Am I doing this correctly? Or is there a more correct approach to secure the connection toward the proxy itself?
Thanks,
Jim
