No certificate at hand, how to proxy https? NGINX TCP Forwarding

An overseas top-up Interface (HTTPS) on the line is often interrupted by my network problem, I want to use HK's machine to do an HTTPS reverse proxy and no certificate.

At first

At first, the idea was to proxy with Nginx TCP forwarding:

Add --with-stream option when compiling Nginx,

upstream backend {   server xxxxxx.com:443 ;}server {    listen 443;    proxy_pass backend;    proxy_connect_timeout 15s;    proxy_timeout 15s;    proxy_next_upstream_timeout 15s;   error_log /data/logs/tcp_xxxxxx.com.log info;}

The server does OK by binding host, transferring https://xxxxxx.com access requests to medium and reverse to the actual overseas server

However, there will also be a problem: 443 port can only be https://xxxxxx.com occupied, can not give other domain name agent to provide role

Later

What if I want https://xxxxxx.com and https://yyyyyy.com to use this machine agent? Nginx's stream_ssl_preread_module can solve this problem.

NGINX (1.11+), compile-time join:--with-stream and --with-stream_ssl_preread_module two options,

Then configure:

map $ssl_preread_server_name $backend_pool {    xxxxxx.com    xxx;    yyyyyy.com    yyy;}upstream xxx{    server xxxxxx.com :443;}upstream yyy{    server yyyyyy.com:443;}server {    listen 443;    ssl_preread on;    resolver 8.8.8.8;    proxy_pass $backend_pool;    proxy_connect_timeout 15s;    proxy_timeout 15s;    proxy_next_upstream_timeout 15s;    error_log /data/logs/tcp_xxxxxx-yyyyyy.com.log info;}

This can give https://xxxxxx.com and https://yyyyyy.com two domain name to do TCP layer proxy, other domain name if also bind host come over will be 403 off.

Here is actually the use of Nginx TCP forwarding made SNI anti-generation, and ordinary http/http difference is that TCP forwarding is only four-layer forwarding does not require a certificate:

• SNI anti-generation: TCP Mirrored Stream replication
• Normal HTTPS reverse: need to hang a certificate two times plus decrypt

In the case of many companies with internal and external network isolation, some development tools of intranet developers need to access the HTTPS Mirror warehouse site (for example: Gradle Plugin), you can use SNI reverse implementation

Reference: http://nginx.org/en/docs/stream/ngx_stream_ssl_preread_module.html

No certificate at hand, how to proxy https? NGINX TCP Forwarding