Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

While I was able to successfully configure nginx to proxy HTTP traffic (using this guide), all attempts to proxy HTTPS requests resulted in code 400 (Bad Request).

Nginx debug logs weren't helpful at all:

2013/06/05 14:38:33 [info] 74946#0: *589
    client sent invalid request while reading client request line, client: 127.0.0.1,
    server: google.com, request: "CONNECT google.com:443 HTTP/1.1"

What are these CONNECT requests? Is it even possible to proxy_pass HTTPS requests in nginx?

Update

Need to add that a proxy server is part of my web development workflow/toolkit. It's a great way to test/debug client-side JavaScript in production environment (using rewrites before the proxy).

Also nginx's config language is arguably a programming language in it's own right. It has variables!

share|improve this question

migrated from stackoverflow.com Jun 6 '13 at 6:48

This question came from our site for professional and enthusiast programmers.

2 Answers 2

Seems like nginx does not support forward proxy mode with SSL. You will need to use something like Squid instead. Here is a link with more explanation from nginx's author: HTTPS and nginx as Forward Proxy.

share|improve this answer
1  
Thanks! The thread you linked is 4 years old, but it also seems to me it's still impossible. –  katspaugh Jun 5 '13 at 22:41
    
If you need a proxy for debugging, try mitmproxy. –  Zorayr Jun 6 '13 at 2:31

Just to clarify: as I wrote on my blog's comment feed, nginx doesn't handle CONNECT method calls which are used to establish a raw TCP connection to a remote host through an HTTP proxy - which makes sense, considering that nginx is not supposed to work as a forward proxy, it just happens to work quite well for regular HTTP regardless.

Nginx just literally has no idea what to do with those method calls, that's why the error messages in the logs are rather useless. I've always found myself using privoxy for HTTPS: http://www.privoxy.org/ - it's insanely easy to set up, too. But it's still impossible to filter or mangle the content of HTTPS relays, because HTTPS connections are handled with a raw connection through the CONNECT method and the server has no idea what it's relaying.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.