Use Separate TLS Contexts for urllib3's Proxy and Website

Load the HTTPS proxy's client certificate in proxy_ssl_context, leaving destination trust and any destination client identity on ssl_context.

import ssl
import urllib3

proxy_tls = ssl.create_default_context(cafile='proxy-roots.pem')
proxy_tls.load_cert_chain('proxy-client.pem', 'proxy-client.key')
origin_tls = ssl.create_default_context()

with urllib3.ProxyManager(
    'https://proxy.example:8443',
    proxy_ssl_context=proxy_tls,
    ssl_context=origin_tls,
    timeout=urllib3.Timeout(connect=5, read=15),
) as http:
    response = http.request('GET', 'https://service.example/data')

Use the actual approved files. proxy-roots.pem verifies the intermediary; proxy-client.pem and its matching private key identify this client to that intermediary. origin_tls keeps the destination's separate trust policy.

The proxy URL's https scheme is essential to that first TLS exchange. For an HTTPS target, urllib3 then sends CONNECT inside the outer TLS session and performs website TLS through the tunnel.

If the website also requires a client certificate, put it on origin_tls. Reusing the proxy identity there would authenticate a different connection.

An ordinary HTTP proxy carrying HTTPS has no outer TLS handshake. An additional HTTP 407 is also separate: providing a client certificate does not supply username/password credentials.

متعلقہ مضامین