Verify the HTTPS Proxy Peer in a Local stunnel Bridge

Expose a loopback plain HTTP endpoint for the application while stunnel validates TLS to the real proxy.

[proxy_tls]
client = yes
accept = 127.0.0.1:3129
connect = proxy.example:8443
verifyChain = yes
CAfile = /path/to/trusted-ca-bundle.pem
checkHost = proxy.example
sni = proxy.example

Use the intended remote proxy and trusted CA bundle. verifyChain checks its issuer chain; checkHost checks its name. sni sends the name but does not verify it.

Point the HTTP-proxy client at the local endpoint:

curl --proxy http://127.0.0.1:3129 https://www.example.org/

The app still performs CONNECT and any required proxy login. stunnel adds the TLS leg, not HTTP authentication. The remote listener must actually implement HTTP proxying over TLS.

For HTTPS websites, destination TLS continues inside this route with its own normal verification. The two certificates identify different peers.

Related articles