1

I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question.

If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/squid (yes, I know they can be set to be https proxy)).

Will the connection between me and the http proxy be encrypted and will the connection between the http proxy and https webpage be encrypted,

1 Answer 1

2

... and they are making me confused, so for a quick yes/no question.

Unfortunately the answer is not a simply yes/no. Instead it depends on the specific setup of client and proxy. While in all cases there will be encrypted traffic between client and proxy and proxy and server it differs on how much visibility the proxy has into the traffic and how much visibility an attacker between client and proxy has.

When a https:// site is accessed using a classic HTTP proxy the client will issue a CONNECT request to the proxy and ask the proxy to create a tunnel to the final server. This tunnel is then used to exchange the end-to-end encrypted HTTPS traffic between client and server. This is thus a client-to-server encrypted traffic, not a client-to-proxy encrypted and then (with new keys) proxy-to-server. The proxy can only see the already encrypted traffic and has no visibility into the decrypted traffic.

But, there are HTTPS intercepting proxies, which don't just forward the encrypted traffic. Instead they terminate the HTTPS traffic at the proxy and create a new HTTPS connection to the server. This means there is an encrypted connection between client and proxy and another encrypted connection between proxy and server and the proxy has full visibility of the decrypted traffic. This setup requires though that the proxy can dynamically create certificates matching the server and that the client trusts these newly create certificates, by trusting the issuing CA at the proxy. This is the kind of setup used for example in corporate proxies. It is also possible to do this with squid.

There is also a way that there is an additional encryption between client and proxy. This is the case if when the proxy itself is accessed by https:// (i.e. not only the server). It works like the normal HTTP proxy, only that the connection from the client to the proxy is also HTTPS. Which means that access to the HTTPS site is doubly encrypted between client and proxy and the proxy removes the first encrypted layer but forwards the inner traffic directly to the server. The common use case for this is an external proxy, where the connection to the proxy itself is unsafe and should be protected against sniffing and manipulation. Otherwise an attacker could for example sniff the target given in the CONNECT request or might even modify the given target. This kind of setup is not supported by all HTTP clients, but it is supported by modern browsers and also by squid - see Encrypted browser connection.

To add to the confusion: encrypted browser connection might also be combined with HTTPS interception.

2
  • wow, that was little longer than than a yes / no answer, but very good written, and I understood the most 😊. so you mean that a request from me to an http proxy is unencrypted, but then is the rest of the communication between me and the proxy encrypted?... yes, I've been trying to configure squid to https, it's tricky, but I haven't given up yet... do you only need a https proxy, and not setup both http and https?
    – JoBe
    Aug 4, 2021 at 6:19
  • 1
    @JoBe: The CONNECT request to the proxy is not encrypted, but it only contains the final target and maybe the authentication against the proxy. The following data after building the tunnel are though the normal TLS traffic, i.e. client-to-server encrypted. Aug 4, 2021 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.