Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

when we use HTTP proxy, we can use it to visit websites with https. In ordinary http proxying, the browser sends HTTP GET in cleartext. HTTP proxy parse the HTTP GET request HOST line to know which website the browser wants to visit.

since in ordinary https, the browser sends HTTP GET in ciphertext, there is no way for the proxy to get to know which destination the browser wants to visit. So when HTTP proxy is set on browsers, the browser send HTTP CONNECT request which show the HOST in cleartext.

now I have a proxy, behind it are several hidden web servers. They are all with different IPs. And only the proxy knows their IPs. each of them has a domain name. Like, myproxy.com, server1.myproxy.com, server2.myproxy.com... but when a browser does a DNS querry for these domain names, the returned IP is the IP of the proxy.

When a browser wants to visit server1.myproxy.com in http, it does a DNS query and get the IP of the proxy. It then connects to the proxy through TCP and send a HTTP GET request. The proxy can parse the HTTP request to know which webserver the browser wants to visit.

but if a browser wants to visit server1.myproxy.com in https, since the browser doesn't set the proxy as default proxy, it will not sendt HTTP CONNECT request. So it seems to me that the proxy will have no ways to know which web server the browser wants to visit.

are there any ways that make the proxy know which web server the browser wants to visit? namely, how to force browser sends HTTP CONNECT request? thanks!

share|improve this question

1 Answer 1

There is no way to tell a browser that the server it is connecting to is actually a proxy. The browser only uses CONNECT when it knows about the proxy (typically, by local configuration).

What you have to do, is to terminate the HTTPS connection at the load balancer and then only talk HTTP (or a different HTTPS connection) between the load balancer and the server farm.

For that to work, the load balancer needs a certificate with multiple server names (commonly known as Subject Alternate Names; preferable) or SSL/TLS server name indication (this does not yet work reliable with all browsers).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.