1

While studying HTTPS and related transport layer security protocols(SSL/TLS), I came to know that HTTPS suffers from two complications - Web-Proxy and Virtual-Hosting.

I can understand how virtual-hosting could be the complication for HTTPS. This is because the underlying transport protocol of HTTPS (SSL or TLS) issues single certificate per IP/PORT combination so hosting multiple sites on single IP would really be an issue while implementing HTTPS. However, I really don't understand how Web-proxy is an issue or complication with HTTPS ? Anybody please clear the concept. Thanks.

1

Web-Proxy

Um, trying to look into my crystal ball here.

Web proxies in general cannot cache SSL connection content, must pass the traffic through unaltered, and cannot view the content as it passes through.

Is this bad for the following reasons?

  • High traffic on your site because of lack of caching (may be able to alleviate with tuning cache settings, allowing browser to cache properly).
  • High traffic on your web-proxy because of lack of caching ... buy a bigger pipe or proxy.
  • Cannot see browser traffic for remote web sites that you don't control (might be porn, viruses, data exfiltration).
  • One obnoxious workaround to this is to install your certificate in the PCs you control and decrypt and re-encrypt traffic at the gateway for your staff (man-in-the middling the connections between your staff and their remote websites).

Virtual-Hosting

Note that this is only a problem for simple configurations using a single IP address and a single Apache installation. Other configurations are:

  • Proper virtual host (Xen, VirtualBox, Virtual PC, etc) with its own public IP address.
  • Server with multiple IP's and One or Two Apache instances configured correctly.
  • Reverse Proxy configuration with 2 External IP Addresses redirected to different HTTPS Daemons on a box running on different ports.
  • There is an extension to HTTPS That allows for multiple SSL Certificates specifically for this use case, I dont know how well it is implemented in Servers, Proxies and Browsers.
| improve this answer | |
1

Current browsers support SNI (server name indication), which sends the name of the target host inside the initial client hello. Thus it is possible to have different https servers on the same IP and current http servers support this. There are still problems with non-browsers (tools and SSL libraries or SSL interfaces in various languages). Some do use SNI by default, others need to explicitly enable SNI and some don't even support it.

I can see no problems with web proxies: the browser just does a CONNECT tunnel to the target host through the proxy and then the rest is normal https, including SNI.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.