Transferred from someone else's article: 78385506
- Clients typically use Web proxy servers to access Web servers on their behalf. For example, many companies place an agent on the corporate network and on the security boundary of the public Internet. A proxy is the only device on the firewall router that allows HTTP traffic to be exchanged, and it may perform virus detection or other content control work.
- But as soon as the client begins to encrypt the data sent to the server with the server's public key, the agent can no longer read the HTTP header. The agent cannot read the HTTP header, and there is no way to know where the request should be diverted.
- In order for HTTPS to work with the agent, several modifications are made to tell the agent where to connect.
- A common technique is the HTTPS SSL Tunneling protocol. With the HTTPS Tunneling Protocol, the client first informs the broker that it wants to connect to the security host and port. This is communicated in clear text before the encryption is started, so the agent can understand this information.
- HTTP sends the endpoint information in plaintext through a new extension method called CONNECT. The Connect method tells the broker to open a connection to the desired host and port number. After this work is completed, the data is transferred directly between the client and the server as a tunnel. The CONNECT method is a single-line text command that provides the host name and port number of a secure original server separated by a colon. Host:port followed by a space and HTTP version string, followed by CRLF. Next is the 0 or more HTTP request header lines followed by a blank line. After a blank line, if the handshake process for establishing a connection completes successfully, you can begin transmitting SSL data.
CONNECT home.netscape.com:443 HTTP/1.0User-agent: Mozilla/1.1N<raw SSL-encrypted data would follow here...>
- After a blank line in the request, the client waits for a response from the agent. The agent evaluates the request to ensure it is valid, and the user has the right to request such a connection. If everything is fine, the agent establishes a connection to the target server. If successful, a Connection established response is sent to the client.
HTTP/1.0 200 Connection established
Proxy-agent: Netscape-Proxy/1.1
Problems with HTTP tunneling
