在服务器端检测客户端是否拒绝我的 TLS 证书

Question

I'm building an HTTP proxy in Node.js, which attempts to intercept HTTPS connections, using a self-signed certificate. I'm using a bare http.Server , instantiating my own tls.TLSSocket to upgrade sockets as required, and the functionality all works great when the CA is trusted by the client.

If the client isn't configured with the CA though, it obviously rejects the connection, complaining that there's a self-signed certificate in the chain.

That's all as it should be, but I'd like a way to detect that this has happened from the server-side, so I can prompt the user to correctly configure their client.

Is it possible to do this? It seems the TLS RFC ( https://tools.ietf.org/html/rfc5246#section-7.2.2 ) has quite a few error alert messages about certificate rejections, which I would expect to cover this, but I can't see to see any debug info in Node about those even with NODE_DEBUG=tls .

Really I'd like to subscribe to TLS error alert events, so I can react to the various interesting cases in there directly. How can I do that?

Answer 1

Usually all what you see is that the client closes the connection. Some clients might send an alert, others don't - the exact behavior depends on the TLS stack. Anyway, you could not redirect the client from within this dead connection anyway.

What you might try is to have some initial page served with plain HTTP where you include some image or similar from a HTTPS resource using a certificate signed with your CA. With some script you can detect if the client has successfully loaded the image or not and in the latter case you can show your information about needing to install some certificate.