0

Is there a proxy (or other solution) that can allow vintage browsers (before HTTPS era - with no or weak SSL/TLS support) to connect with HTTPS websites?

In other words:

old browser <-- http connection --> client (local) proxy <-- HTTPS connection --> any internet web page

(browser sends http page request to local proxy, it sends HTTPS request, and after receiving HTTPS response/page, proxy returns that to browser in unencrypted http)

Simple example configurations for such proxies are welcomed as well.

Is the TLS_termination_proxy (https://serverfault.com/questions/943649/https-http-lightweight-proxy) what I'm looking for (or is it only for servers)?

I have started checking the proxies from TLS_termination_proxy list (Nginx, stunnel, Hiawatha, Caddy, Apache and Squid) for Windows. Nginx seems to be able to do that. stunnel is only for 64-bit.

  • Nginx reverse proxy? – Daniel Sep 30 '19 at 2:54
  • @Daniel Could you post sample config of what you have in mind? Most examples are for converting https request to one known http backend (like chase-seibert.github.io/blog/2011/12/21/…), I want the opposite - proxy listens on http and "converts" http browser request to https, then returns received https response to browser by http (only proxy handles https connections, browser communicates to proxy only by http). It's not simple redirect to one target (unless redirect in Nginx doesn't cause change of protocol for browser?). – MarMi00 Sep 30 '19 at 15:24
0

Use Nginx as a reverse proxy for all requested domains.

server {
  # default_server not needed if its first server in config
  listen 80 default_server;
  location / {
    # x.x.x.x - IP address of DNS server
    resolver x.x.x.x;
    # port may be omitted
    proxy_pass https://$host:443;
  }
}

You also most likely will want to take care of hard-coded urls for scripts/images (and others) by modifying pages (Modify HTML pages returned by nginx reverse proxy), or by adding additional server for ssl request (if browser supports https protocol).

  • Tested on http:// google.pl, result: 502 Bad Gateway, error: *10 no resolver defined to resolve www.google.pl, client: 127.0.0.1, server: , request: "GET http:// www.google.pl/ HTTP/1.1", host: "www.google.pl" – MarMi00 Sep 30 '19 at 16:57
  • Solved above - "resolver x.x.x.x;" is needed. Also redirection protection is needed (for example for http:// request.urih.com which sends 301 Moved Permanently) – MarMi00 Sep 30 '19 at 17:26
  • Maybe you can edit the answer to include your changes. – Daniel Sep 30 '19 at 18:02
  • I guess that https server is also needed, for scripts with https adress in script tag (like for http:// worldwideweb.cern.ch/browser). Something like this: ``` server { listen 443 ssl default_server; ssl_certificate cert.pem; ssl_certificate_key cert.key; #... location / { # x.x.x.x - ip of DNS server resolver x.x.x.x; proxy_pass http://$host:80; } } ``` – MarMi00 Sep 30 '19 at 19:06
  • Or modify the page on the fly (serverfault.com/questions/713148/…). – MarMi00 Sep 30 '19 at 19:36
0

Nginx as an url proxy (in form of http://localhost/proxy/?u=url_to_process), for browsers without proxy support (tested in Mosaic 1.0 and Cello from 1993 on Windows [Cello doesn't recognize localhost, you must use 127.0.0.1 instead]):

server {
    listen       80;

    # dns server
    resolver x.x.x.x;

    location /proxy {
        #is ending slash missing? (avoid redirection)
        #**TODO**: handle file url
        if ($arg_u !~ /$) {
            set $slash "/";
        }

        proxy_pass $arg_u$slash;

        #handle eventual redirection to https
        set $url_proxy http://localhost/proxy/?u=;
        proxy_redirect ~^(https://.+) $url_proxy$1;
    }
}

This allows to display single page passed in parameter u (example: http://localhost/proxy/?u=http://www.aliweb.com). In some cases, passing http page (theoretically supported by browser) by proxy can result in better parsing of that page by browser. In other cases it can cause a browser crash. Page modification is needed in order to freely browse a site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.