3 ms·

What you did doesn't sound like MITM/TLS interception. Assuming you meant you set those environment variables for your applications, then that wasn't mitm. It

by TheDong 10y ago

What you did doesn't sound like MITM/TLS interception. Assuming you meant you set those environment variables for your applications, then that wasn't mitm. It was application-level supported proxying. Those are totally different things.

paulddraper 10y ago
I apparently was unclear. I set up a caching MITM TLS proxy (with a trusted cert on my CI server).
- majewsky 10y ago
  Why would you even need that? If you have `https_proxy=http://caching-proxy.local` http://caching-proxy.local` with `http://` http://` rather than `https:`, the client will use HTTP to connect to the proxy, and the proxy will connect to the destination using HTTPS. Since the client itself does not do any TLS, you don't need any CA cert shenanigans in this setup, and you can still intercept all the traffic on the proxy. (Of course, this means that traffic between the client and the proxy is unencrypted, so if you do not trust that network, you will need to add a VPN or similar there.)
  - deleted 10y ago
    [deleted]
  - paulddraper 10y ago
    It would be very convenient if it worked that way, but it doesn't. $ https_proxy=http://localhost:8888 curl -vo /dev/null https://example.org * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8888 (#0) * Establish HTTP proxy tunnel to example.org:443 > CONNECT example.org:443 HTTP/1.1 > Host: example.org:443 > User-Agent: curl/7.35.0 > Proxy-Connection: Keep-Alive > < HTTP/1.0 200 Connection established < Proxy-agent: tinyproxy/1.8.3 * Proxy replied OK to CONNECT request * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs ... * Server certificate: * subject: C=US; ST=California; L=Los Angeles; O=Internet Corporation for Assigned Names and Numbers; OU=Technology; CN=www.example.org * start date: 2015-11-03 00:00:00 GMT * expire date: 2018-11-28 12:00:00 GMT * subjectAltName: example.org matched * issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA * SSL certificate verify ok. ... The protocol defined in https_proxy is irrelevant. CONNECT will be used, with a TLS tunnel.
    - majewsky 10y ago
      That's odd. I use mitmproxy at work to check how my apps call REST APIs on HTTPS endpoints, and I definitely don't have mitmproxy's interception CA installed.

by TheDong 10y ago

paulddraper 10y ago

I apparently was unclear. I set up a caching MITM TLS proxy (with a trusted cert on my CI server).

majewsky 10y ago
Why would you even need that? If you have `https_proxy=http://caching-proxy.local` http://caching-proxy.local` with `http://` http://` rather than `https:`, the client will use HTTP to connect to the proxy, and the proxy will connect to the destination using HTTPS. Since the client itself does not do any TLS, you don't need any CA cert shenanigans in this setup, and you can still intercept all the traffic on the proxy. (Of course, this means that traffic between the client and the proxy is unencrypted, so if you do not trust that network, you will need to add a VPN or similar there.)
- deleted 10y ago
  [deleted]
- paulddraper 10y ago
  It would be very convenient if it worked that way, but it doesn't. $ https_proxy=http://localhost:8888 curl -vo /dev/null https://example.org * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8888 (#0) * Establish HTTP proxy tunnel to example.org:443 > CONNECT example.org:443 HTTP/1.1 > Host: example.org:443 > User-Agent: curl/7.35.0 > Proxy-Connection: Keep-Alive > < HTTP/1.0 200 Connection established < Proxy-agent: tinyproxy/1.8.3 * Proxy replied OK to CONNECT request * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs ... * Server certificate: * subject: C=US; ST=California; L=Los Angeles; O=Internet Corporation for Assigned Names and Numbers; OU=Technology; CN=www.example.org * start date: 2015-11-03 00:00:00 GMT * expire date: 2018-11-28 12:00:00 GMT * subjectAltName: example.org matched * issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA * SSL certificate verify ok. ... The protocol defined in https_proxy is irrelevant. CONNECT will be used, with a TLS tunnel.
  - majewsky 10y ago
    That's odd. I use mitmproxy at work to check how my apps call REST APIs on HTTPS endpoints, and I definitely don't have mitmproxy's interception CA installed.