CODEWITHSUNDEEP
httpsslproxy
Marc
Marc

Reputation: 139

HTTP proxy SSL tunneling relay details

I am trying to wrap my head around the ssl Tunneling process which is performed by an http proxy after receiving the CONNECT method from a client.

Stuff I can't seem to find or understand in docs, blogs, rfcs:

1) when setting up the tunnel, are the two connections from client-proxy and proxy-destination two separate connections or just one and the same? E.g. is there an tcp handshake between client-proxy and another between proxy-destination?

2) when starting the ssl handshake what node is targeted (ip address/hostname) by the client? The proxy or the destination host? Since ssl requires a point-to-point connection to make the authentication work my feeling tells me it should be the destination host. But then again that wouldn't make sense since the destination host isn't (directly) accessible from the clients perspective (hence the proxy).

Upvotes: 2

Views: 793

Answers (1)

Steffen Ullrich
Steffen Ullrich

Reputation: 123320

when setting up the tunnel, are the two connections from client-proxy and proxy-destination two separate connections or just one and the same? E.g. is there an tcp handshake between client-proxy and another between proxy-destination?

Since the client makes the TCP connection to the proxy there is no other way than that the proxy is making another TCP connection to the server. There is no way to change an existing TCP connection to be connected to a different IP:port.

when starting the ssl handshake what node is targeted (ip address/hostname) by the client? The proxy or the destination host?

The SSL handshake is done with the destination host, not the proxy.

Since ssl requires a point-to-point connection to make the authentication

It doesn't need a point-to-point connection. It just needs that all data gets exchanged unmodified between client and server which is the case when the proxy simply forwards the data.

Upvotes: 3

Related Questions