Forward Proxy convert http to https

Apache2PROXYsquid

We have access to a remote web API that requires a client cert to access (it's a PKI). I want to allow access to this API for specific servers / IPs in our network without them having to import the client cert into the keystore and also enable them to use http and not https. We cannot use a reverse proxy approach for a couple of reasons I would rather not get into.

Is there any way to talk http from client to proxy and from there use https (with the client-cert) to the server? I have seen ways to achieve this in squid using SslBump but only when https is being used from the client. I have seen a few questions like this for Apache but they all use ProxyPass which according to here Apache Module mod_proxy | apache.org is only for reverse-proxying.

To illustrate:

I am open to using squid, apache or any web server that provides real forward proxy capabilities.

Best Answer

A Squid server configured as a forward proxy is able to receive plain HTTP requests from clients and forward HTTPS requests to upstream servers transparently. However, an external URL rewrite program is needed.

Write the following URL rewriting program into /etc/squid/urlrewrite.pl:

#!/usr/bin/perl
select(STDOUT);
$| = 1;
while (<>) {
    if (/^(|\d+\s+)((\w+):\/+)([^\/:]+)(|:(\d+))(|\/\S*)(|\s.*)$/) {
        my $channel = $1;
        my $protocolClean = $3;
        my $domain = $4;
        my $port = $5;
        my $portClean = $6;
        my $urlPath = $7;
        if ($protocolClean eq 'http' && ($port eq '' || $portClean eq '80')) {
            print STDOUT "${channel}OK rewrite-url=\"https://${domain}${urlPath}\"\n";
        } else {
            print STDOUT "${channel}ERR\n";
        }
    }
}

Then, add these configuration parameters into /etc/squid/squid.conf:

acl pkiRestDomain dstdomain -n pki.globalpki123.com
acl pkiRestUrlPath urlpath_regex ^/rest(|\/.*)$
url_rewrite_program /etc/squid/urlrewrite.pl
url_rewrite_access allow pkiRestDomain pkiRestUrlPath
sslproxy_client_certificate /etc/pki/squid/certs/mylocalproxy.crt
sslproxy_client_key /etc/pki/squid/private/mylocalproxy.key

Adjust sslproxy_client_certificate and sslproxy_client_key according to the actual path of the client certificate that Squid will use.

Related Topic