1

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.

  • So just to clarify, you do not care at all if the data you send or the data you receive is in any way "sane"? So if your server sent "Let's make an office party" and the recipient would receive "Kill everybody and make it look like an accident", that would be perfectly fine in your use-case? – MechMK1 May 20 at 10:56
  • 1
    Rather then saying what all is not important it might be more useful to say what is actually important to you, i.e. describe your specific use case. For example if you want to check if a specific server is up then checking the certificate does not seem to be relevant at first. But you actually want to be sure that you have reached the correct server since you want to know if the actual server is up and are not interested if some SSL intercepting firewall in the middle is up. Only by knowing the actual use case the risk can be evaluated so please edit your question accordingly. – Steffen Ullrich May 20 at 11:00
  • MechMK1 the response will be checked against a non-proxied response to check for tampering. But, as Steffen Ullrich pointed out, the main goal is to verify that the proxy server is able to connect to the desired host. – user208405 May 20 at 11:04