How does Forward Proxy work when the browser is going to a secure (SSL) website?

(Last modified: 05May2003)

This document (10077499) is provided subject to the disclaimer at the end of this document.

goal

fact

Secure web server (SSL/HTTPS)

Novell Volera Excelerator

fix

1 - browser makes connection to proxy on port 8080

2 - browser issues HTTP CONNECT method, asking proxy to make SSL tunnel to origin web server

3 - proxy resolves DNS hostname for origin server

4 - proxy makes connection to origin on port 443

5 - proxy replies to browser ""HTTP/1.0 200 Connection established"" to tell the browser that the SSL tunnel has been established.

6 - browser and origin do SSL certificate exchange. Proxy is used, but just as a tunnel - SSL certificate info is not modified in any way by the proxy

7 - browser sends ""GET /"" to origin server (via SSL tunnel through proxy) with host header filled out by browser. Again, proxy does not modify host header, as data is just being ""tunneled""

For clarification, in forward proxy mode, the host header sent by the browser is not modified in any way by the proxy. The browser does not actually send the host header until the SSL tunnel has been established.

document

Document Title:	How does Forward Proxy work when the browser is going to a secure (SSL) website?
Document ID:	10077499
Solution ID:	NOVL84675
Creation Date:	06Dec2002
Modified Date:	05May2003
Novell Product Class:	Volera

disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.
Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.