2

I have designed a framework for my application where I have a proxy to communicate with the outside world. The connection between proxy and the application is encrypted using SSL.

But the connection between the application and proxy is NOT encrypted. I have lots of applications. What is the best way of doing this?

Improve this question
2
  • 2
    Where does the application live? What is outside world ? Internet ? What do you mean by: "The connection between proxy and the application is encrypted using SSL. But the connection between the application and proxy is NOT encrypted"
    – CodeExpress
    Jul 8, 2012 at 7:23
  • @Shivam application is in a tablet. Outside world means a wifi connection to another device. application sends data to proxy and proxy sends it to the gateway over wifi
    – user2315
    Jul 8, 2012 at 8:13

2 Answers 2

Reset to default
1

Your question is a bit confused (you state that "the connection between proxy and the application is encrypted using SSL" and then that "the connection between the application and proxy is NOT encrypted": apparently, you are using the term "application" to designate several distinct things).

That being said:

  • SSL is meant to be end-to-end. When the SSL client talks to the SSL server, they establish a tunnel which is safe from third parties (for confidentiality and integrity of data). This property holds even against whatever proxies the connection has gone through.

  • HTTPS (i.e. HTTP within SSL) can be forwarded through a proxy (see RFC 2817 sections 5.2 and 5.3).

  • An HTTP proxy is contacted through HTTP -- theoretically, it should be possible to contact it through HTTPS too, but browsers are not necessarily configurable that way. I have seen it done with a Proxy auto-config file which was returning the proxy not as an hostname+port pair, but as a full URL (beginning with https), which is out of spec, but was working (I don't remember which browser supported that, though).

So you could make a SSL connection through a proxy, the tunnel between the application and the proxy being itself an SSL tunnel; at which point you would have two SSL tunnels, one nested in the other. But what would be the use ? If the data is sensitive enough to warrant SSL, then it should use SSL on the whole path, even beyond the proxy. And if it does use SSL for the whole path, then an SSL layer between application and proxy is superfluous.

(HTTPS with proxy makes sense when the proxy requires password-based authentication, and you fear interception of that password, though.)

Improve this answer
1
  • Mostly agree, however a proxy can serve a number of functions not least of which is caching and load balancing - in order to do these it needs access to the unencrypted data. Further as a bottleneck there's a lot more traffic between the proxy and back end than between the client and the proxy - using the same chanel all the way through doesn't make best use of available resources. So you could use SSL between proxy and application - but it has to be independent of the proxy to client connecton. You could avoid a lot of performance overhead using a tunelled connection at the back end.
    – symcbean
    Jan 14, 2013 at 0:20
0

You could either set up a ssl based proxy (apache will handle this with the right config) or create an ssh tunnel which would funnel the traffic to the proxy server over an encrypted channel, even if the traffic itself is not encrypted.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .