使用 s_client 进行代理身份验证

Question

_{Note: this is not a duplicate of openssl s_client using a proxy , as I am specifically interested in proxy authentication, not the ability to use proxy.}

I'm using openssl s_client to inspect certificates of the target server to understand how/where the connection works or not. As I'm behind a corporate proxy, I can specify the proxy server with -proxy flag, however I need to pass authentication details (username/password) to this proxy - and I haven't figured out how to do that.

openssl s_client -proxy my.proxy.server:8080 -connect my.target.host

successfully connect to the proxy server, however, understandably, results in error s_client: HTTP CONNECT failed: 407 Unauthorized .

Passing proxy server in the form of user:pass@my.proxy.server or http://user:pass@my.proxy.server both result in error s_client: -proxy argument malformed or ambiguous .

How can I pass proxy authentication to s_client? I would find it hard to believe that it supports proxy but not authenticated proxy.

I'm using openssl version 1.1.1a.

Answer 1

You can use escape-from-intranet https://github.com/quaddy-services/escape-from-intranet#introduction

and specify

host=my.proxy.server
port=8080

in the app and use

openssl s_client -proxy localhost:3128 -connect my.target.host

and your local running application will enrich the real proxy call with your credentials.

(In case you have a transparent proxy you need to switch the default proxy decision to "PROXY" in the "Decision" Menu)

Answer 2

openssl v3.0 will supports proxy_user and proxy_pass options.

no solution for now, the syntax after proxy is

 host + ':' + service
 host + ':' + '*'
 host + ':'
        ':' + service  
 '*'  + ':' + service
 host
 service

cf.BIO_parse_hostserv

Answer 3

Just to follow up on @Arnaud Grandville's answer: OpenSSL v3 beta 1 has now been released, and it includes proxy authentication options. You have to compile it yourself, however.

Unfortunately in v3 beta 1 the HTTP code had some issues so you can't use the code from their website as-is. Anyone looking to compile from source can use the commands below to get an OpenSSL installation with working proxy authentication:

git clone --branch openssl-3.0.0-beta1 https://github.com/openssl/openssl.git
cd openssl
git fetch
git checkout 6a1f9cd -- crypto/http/http_client.c
./Configure
make
make install