hi @friskfly , I have made connect tunnel over ssl work. I'm currenty using chrome-https-proxy-setting with ngx_http_proxy_connect_module to write this comment :)

data stream diagram:

1. create tunnel:

[SSL] + [CONNECT request] --> nginx --TCP connection --> backend

2. proxy data stream via tunnel

[SSL] + [proxied data stream ( maybe http reqeust /https request)] --> nginx -- [proxied data stream ( maybe http reqeust /https request)] --> backend

How to use ngx_http_proxy_connect_module as https proxy

ngx_http_proxy_connect_module configure:

config Nginx server to handle CONNECT tunnel over ssl in port 8443

    server {
        listen       8443 ssl;

        server_name  localhost;

        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
        ssl_certificate     /Users/xiaochen/work/nginx/cert.pem;
        ssl_certificate_key /Users/xiaochen/work/nginx/cert.key;
        ssl_session_cache   shared:SSL:10m;
        ssl_session_timeout 10m;

        resolver 8.8.8.8;

        ### connect tunnel
        proxy_connect;
        proxy_connect_allow            443 563;
        proxy_connect_connect_timeout  10s;
        proxy_connect_read_timeout     10s;
        proxy_connect_send_timeout     10s;

        location / {
            proxy_set_header Host $host;
            proxy_pass http://$host;
        }
    }

Google Chrome https proxy setting

Note that I use chrome extension SwitchyOmega to control proxy setting. Select HTTPS in protocol option.

Google Chrome Error: ERR_PROXY_CERTIFICATE_INVALID

The main problem, I try to resolve, is chrome reporting error: ERR_PROXY_CERTIFICATE_INVALID.
If you have the same problem, I can show how to fix.

Note that I'm using macOS Sierra(version 10.12.6) and Goolge Chrome (Version 62.0.3202.94 (Official Build) (64-bit)).

use the following script to generate SSL certificate & key.

$ cat genkey.sh
#!/bin/bash

openssl req \
  -newkey rsa:2048 \
  -x509 \
  -nodes \
  -keyout cert.key \
  -new \
  -out cert.pem \
  -subj /CN=localhost \
  -reqexts SAN \
  -extensions SAN \
  -config <(cat /System/Library/OpenSSL/openssl.cnf \
       <(printf '[SAN]\nsubjectAltName=DNS:localhost')) \
  -sha256 \
  -days 3650
$ ./genkey.sh
$ ls
cert.key   cert.pem

install generated certificate cert.pem as a trusted root certificate on macOS:

1 Open Keychain Access
2 Choose "System" in the "Keychains" list
3 Choose "Certificates" in the "Category" list
4 Choose "File | Import Items..."
 Browse to the file created above, "cert.pem", select it, and click "Open"
 Select your newly imported certificate in the "Certificates" list.
5. Click the "i" button, or right click on your certificate, and choose "Get Info"
 Expand the "Trust" option
 Change "When using this certificate" to "Always Trust"
 Close the dialog, and you'll be prompted for your password.

For more details, see https://stackoverflow.com/questions/7580508/getting-chrome-to-accept-self-signed-localhost-certificate.

Here is my configure screenshot:

Can it used as a https proxy to tunnel tcp? #22

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier! Saves Data!