2

Is there a proxy (or other solution) that can allow vintage browsers (before HTTPS era - with no or weak SSL/TLS support) to connect with HTTPS websites?

In other words:

old browser <-- http connection --> client (local) proxy <-- HTTPS connection --> any internet web page

(browser sends http page request to local proxy, it sends HTTPS request, and after receiving HTTPS response/page, proxy returns that to browser in unencrypted http)

Simple example configurations for such proxies are welcomed as well.

Is the TLS_termination_proxy (https://serverfault.com/questions/943649/https-http-lightweight-proxy) what I'm looking for (or is it only for servers)?

I have started checking the proxies from TLS_termination_proxy list (Nginx, stunnel, Hiawatha, Caddy, Apache and Squid) for Windows. Nginx seems to be able to do that. stunnel is only for 64-bit.

2
  • Nginx reverse proxy?
    – Daniel
    Sep 30 '19 at 2:54
  • @Daniel Could you post sample config of what you have in mind? Most examples are for converting https request to one known http backend (like chase-seibert.github.io/blog/2011/12/21/…), I want the opposite - proxy listens on http and "converts" http browser request to https, then returns received https response to browser by http (only proxy handles https connections, browser communicates to proxy only by http). It's not simple redirect to one target (unless redirect in Nginx doesn't cause change of protocol for browser?).
    – MarMi00
    Sep 30 '19 at 15:24
1

Any of the following projects would work in your case.

  1. OldSSL Proxy—SSL/TLS (HTTPS) proxy server for outdated operating systems like Windows XP
  2. mitmproxy-oldssl—Docker image of mitmproxy with OpenSSL reconfigured to enable SSLv3; can be configured to act as an SSL downgrade proxy for old machines
  3. WebOne—HTTP 1.x proxy that makes old web browsers usable again in the Web 2.0 world.
1
  • Thanks. The first two require that the (old) browser supported a proxy and the SSL3, the WebOne seems to be the most advanced for my purposes (supports very old browsers without SSL and proxy support) - can convert graphics and videos, has an archive.org support, and can modify web page contents (according to the documentation).
    – MarMi00
    Mar 2 at 22:32
1

Use Nginx as a reverse proxy for all requested domains.

server {
  # default_server not needed if its first server in config
  listen 80 default_server;
  location / {
    # x.x.x.x - IP address of DNS server
    resolver x.x.x.x;
    # port may be omitted
    proxy_pass https://$host:443;
  }
}

You also most likely will want to take care of hard-coded urls for scripts/images (and others) by modifying pages (Modify HTML pages returned by nginx reverse proxy), or by adding additional server for ssl request (if browser supports https protocol).

10
  • Tested on http:// google.pl, result: 502 Bad Gateway, error: *10 no resolver defined to resolve www.google.pl, client: 127.0.0.1, server: , request: "GET http:// www.google.pl/ HTTP/1.1", host: "www.google.pl"
    – MarMi00
    Sep 30 '19 at 16:57
  • Solved above - "resolver x.x.x.x;" is needed. Also redirection protection is needed (for example for http:// request.urih.com which sends 301 Moved Permanently)
    – MarMi00
    Sep 30 '19 at 17:26
  • Maybe you can edit the answer to include your changes.
    – Daniel
    Sep 30 '19 at 18:02
  • I guess that https server is also needed, for scripts with https adress in script tag (like for http:// worldwideweb.cern.ch/browser). Something like this: ``` server { listen 443 ssl default_server; ssl_certificate cert.pem; ssl_certificate_key cert.key; #... location / { # x.x.x.x - ip of DNS server resolver x.x.x.x; proxy_pass http://$host:80; } } ```
    – MarMi00
    Sep 30 '19 at 19:06
  • Or modify the page on the fly (serverfault.com/questions/713148/…).
    – MarMi00
    Sep 30 '19 at 19:36
0

Nginx as an url proxy (in form of http://localhost/proxy/?u=url_to_process), for browsers without proxy support (tested in Mosaic 1.0 and Cello from 1993 on Windows [Cello doesn't recognize localhost, you must use 127.0.0.1 instead]):

server {
    listen       80;

    # dns server
    resolver x.x.x.x;

    location /proxy {
        #is ending slash missing? (avoid redirection)
        #**TODO**: handle file url
        if ($arg_u !~ /$) {
            set $slash "/";
        }

        proxy_pass $arg_u$slash;

        #handle eventual redirection to https
        set $url_proxy http://localhost/proxy/?u=;
        proxy_redirect ~^(https://.+) $url_proxy$1;
    }
}

This allows to display single page passed in parameter u (example: http://localhost/proxy/?u=http://www.aliweb.com). In some cases, passing http page (theoretically supported by browser) by proxy can result in better parsing of that page by browser. In other cases it can cause a browser crash. Page modification is needed in order to freely browse a site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.