I'm confused about how ssh dynamic port forwarding operates with https. Assuming 3 machines:
- A runs a web browser
- B runs sshd
- C is a web server
On A, I "ssh -D 12345 user@B" and configure the browser to use the SOCKS proxy at localhost:12345. I can check the host key of B, and if I was directly viewing an https site (A -> C) I could check the certificate to notice a MitM.
What I want to know is: where does the https decryption take place when the proxy is in-place?
Is ssh at B just forwarding unmodifed packets received from C (wrapped in its own layer of encryption obviously) to A for decryption in the browser, or have I effectively man-in-the-middled the A->C connection myself? If ssh at B was decrypting data from C, before re-encrypting it to send back to A, that would be undesirable as the data now exists (albeit only in memory) in a decrypted state on B. Which of the two scenarios is it? I'm assuming it's the former, but I want to be clear about what is going on. Thank you