-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ssl handshake error with authenticated http proxy #650
Comments
You are right, proxy implementation has only basic auth support (no NTLM support or discovery). |
thank you for taking a look, hmm It doesn't look like a cert error, the error is in the SSL handshake which precedes certificate exchange. I am also able to connect successfully when no proxy authentication is used, which makes me suspect the initial connection made to the proxy might be faulty. I will try testing against a different proxy and check if I see the same results. |
Hello, let me add some notes :
To say more, we (in our project) use patch for sdk that allows to set handshake handler and certificate (I wonder why it was not implemented). And I can say that sdk works for me with CCProxy and squid. |
ohh interesting, if CCProxy works but Squid does not, it seems this would point to an issue with the proxy (or a specific compatibility issue). From my reading of the tcpdumps the way the TLS setup happens is with squid proxy auth I see the server terminate connection at step 2, so we never get to the point of server returning its certificate. Thanks for the information, I'll run the test against a different proxy and hopefully be able to pinpoint if this is an issue with the specific proxy used |
So after some more debugging I think I have gotten to the bottom of this I am testing this with squid proxy. |
I can confirm the issue is present.
|
Hello guys, |
I found this and try lots of possibilities but finally get that our server certificate was not valid and with replace with valid certificate this issue gone. This is also my question link in stackoverflow to see what was my condition.https://stackoverflow.com/q/60443490/1498586 |
I'm seeing an issue when connecting to a server using https through a http proxy using basic authentication (username/password). The exception returned from request is "Error in SSL handshake"
I am able to make the connection successfully without proxy authentication. Also I have done a curl test which succeeds with/without authentication
Looking through packet traces in wireshark I see the following
with curl
1: curl -> to proxy: CONNECT
2: proxy -> curl: Proxy Authentication Required
3: curl-> proxy: CONNECT with Authentication
4: proxy -> curl sdk Conection established
5 curl -> proxy client Hello to server url
6 proxy -> server Client Hello
7 server -> proxy Server Hello
8: proxy -> sdk Server Hello
... Successfully completes TLS handshake
with cpprestsdk
1: sdk -> proxy: CONNECT with auth
It looks like with sdk we just have one authentication scheme (BASIC) and don't do the authentication discovery step like curl above. Is this correct?
2: proxy -> sdk connection established
3: sdk -> proxy Client Hello
4: stray packet with protocol SSL going to server, wireshark marks this packet as "Continuation Data"
5: proxy -> server Client Hello
6: server -> sdk FIN, ACK terminating the connection
I believe the server ins't completing the handshake because of that stray packet in step 4. I cannot tell what is generating this packet. I do not see this packet being sent from sdk to proxy. I was wondering if this packet might be generated because of the way the connection to the http proxy is formed. I compared at the Client Hello packets between successful and failed attempts and those seem to match up.
I have tested on mac and linux with the squid proxy.
The text was updated successfully, but these errors were encountered: