HTTPS question

HTTPS question
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
HTTPS question Rich Fife 02-14-2008
Posted by Rich Fife on February 14, 2008, 2:41 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello all,

Hope this isn't a total newbie question...

I'm writing an extension to an existing client / server suite that
currently uses UDP for all of its communication.

We are having some problems with clients that are behind firewalls
that only allow HTTP and HTTPS, so I've created a system where the
necessary communications all take place in the form of GET and PUT
HTTP calls. This makes the proxy think that the client is simply
browsing the web when they are not. Yeah, lame, but it works for
HTTP. I need to implement a version that uses HTTPS as well. I've
got all my certificates ready and it works between the client and the
server if there is no proxy, but the question I'm having trouble
answering is how do you implement HTTPS from the TCP / SSL level?

Do you send an unencrypted HTTP header and then pop over to SSL
immediately afterwards? When do you do the SSL handshaking? Before
or after you send the header?

Thanks in advance!

-- Rich Fife --

Posted by Bruce Stephens on February 14, 2008, 2:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

[...]

> Do you send an unencrypted HTTP header and then pop over to SSL
> immediately afterwards? When do you do the SSL handshaking? Before
> or after you send the header?

Start straight off with SSL/TLS. (I believe there's a proposal for an
HTTP startTLS, but I don't think it's caught on.)

Posted by Rich Fife on February 14, 2008, 5:36 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Feb 14, 11:55 am, Bruce Stephens <bruce
+use...@cenderis.demon.co.uk> wrote:
>
> [...]
>
> > Do you send an unencrypted HTTP header and then pop over to SSL
> > immediately afterwards? When do you do the SSL handshaking? Before
> > or after you send the header?
>
> Start straight off with SSL/TLS. (I believe there's a proposal for an
> HTTP startTLS, but I don't think it's caught on.)

So I do an SSL handshake directly with the proxy and then it
handshakes with the server? If I don't, how does the proxy know what
server I want (it's only in the (encrypted) HTTP header)?

Thanks for your reply!

-- Rich --

Posted by Sebastian G. on February 14, 2008, 5:40 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Rich Fife wrote:

> On Feb 14, 11:55 am, Bruce Stephens <bruce
> +use...@cenderis.demon.co.uk> wrote:
>>
>> [...]
>>
>>> Do you send an unencrypted HTTP header and then pop over to SSL
>>> immediately afterwards? When do you do the SSL handshaking? Before
>>> or after you send the header?
>> Start straight off with SSL/TLS. (I believe there's a proposal for an
>> HTTP startTLS, but I don't think it's caught on.)
>
> So I do an SSL handshake directly with the proxy and then it
> handshakes with the server? If I don't, how does the proxy know what
> server I want (it's only in the (encrypted) HTTP header)?


First you create a connection to the proxy which may or may not be secured
with SSL. Then you send a CONNECT request to the proxy, telling him the host
you want to talk to. He then sets up the connection and proxies all traffic,
and if it's secured with SSL then he doesn't know the content.

Posted by Rich Fife on February 14, 2008, 6:01 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Rich Fife wrote:
> > On Feb 14, 11:55 am, Bruce Stephens <bruce
> > +use...@cenderis.demon.co.uk> wrote:
>
> >> [...]
>
> >>> Do you send an unencrypted HTTP header and then pop over to SSL
> >>> immediately afterwards? When do you do the SSL handshaking? Before
> >>> or after you send the header?
> >> Start straight off with SSL/TLS. (I believe there's a proposal for an
> >> HTTP startTLS, but I don't think it's caught on.)
>
> > So I do an SSL handshake directly with the proxy and then it
> > handshakes with the server? If I don't, how does the proxy know what
> > server I want (it's only in the (encrypted) HTTP header)?
>
> First you create a connection to the proxy which may or may not be secured
> with SSL. Then you send a CONNECT request to the proxy, telling him the host
> you want to talk to. He then sets up the connection and proxies all traffic,
> and if it's secured with SSL then he doesn't know the content.

Ah. I get it. I was going straight for GET and PUT without using
CONNECT. That's the magic word I was looking for.

Thanks!

-- Rich --

Similar ThreadsPosted
Https question August 21, 2005, 12:28 am
A basic/newbie question on https. January 30, 2008, 8:55 pm
HTTPS and URL encoding May 26, 2004, 7:04 pm
SSL/https De-encryption July 6, 2004, 9:15 am
How does HTTPS/SSL work? November 24, 2004, 3:40 pm
Https funda August 11, 2005, 8:09 am
https + security April 1, 2008, 7:02 pm
Re: https + security April 2, 2008, 12:40 am
https / proxy problem January 11, 2006, 10:59 am
HTTPS but still non secure form? March 14, 2006, 4:39 am

The site map in XML format XML site map

Contact Us | Privacy Policy