Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My goal is to intercept traffic from my machine, and do some reverse engineering on existing prototocols.

To do so I have a closed-source client, and a closed-source remote server. The remote server only runs on port 443, and the client cannot be tricked to connect to a server with the wrong certificate.

So my question is as follows: how can I (with ssh, stunnel, or some other command line tool) open up a local unencrypted port, and have the traffic wrapped to a remote https based server.

share|improve this question

migrated from Oct 17 '12 at 15:42

This question came from our site for professional and enthusiast programmers.

up vote 2 down vote accepted

If the client can only connect to an SSL/TLS server and cannot be tricked to accept the wrong certificate, you won't be able to intercept the communication. That's the whole point of using SSL/TLS and checking the certificate properly.

If you can make the client connect to a plain HTTP port (that sounds unlikely, but if you can change the address it's connecting to, it might be possible), in this case, you could indeed use stunnel as an SSL/TLS client.

share|improve this answer
In this particular case the client cannot be tricked into accepting the wrong certificate IF the hostname matches a certain value. This is an Apple product (iCal) and they basically circumvent the operating systems certificate repository if, and only if they connect to iCloud. – Evert Oct 17 '12 at 18:57
If it works with another host, e.g. localhost, using http://localhost/... and using stunnel in client mode (that is, as a plain TCP server and an SSL/TLS client), this could work. – Bruno Oct 17 '12 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .