Establish CONNECT Before Starting an Asio TLS Handshake

Use an Asio SSL stream's next layer for the plain HTTP proxy exchange, then start TLS through the accepted tunnel.

For ssl::stream<tcp::socket> through an ordinary HTTP proxy, use its raw transport before asking it to perform destination TLS:

auto& transport = tlsStream.next_layer();
  1. Connect that transport to the proxy host and port. For a permitted public HTTPS destination with no proxy credentials configured, the HTTP proxy list offers candidate endpoints; check that the candidate allows the requested tunnel.
  2. Send CONNECT naming the destination authority, such as api.example:443, and parse the complete response headers on the plain transport. A successful 2xx opens the tunnel; a refusal remains an HTTP proxy response.
  3. Configure the destination hostname, required SNI, trust roots and peer verification, then start the client handshake on tlsStream.
  4. After TLS succeeds, use SSL-stream reads and writes for the application. Reading the next layer directly at that point bypasses TLS processing.

Carry any HTTP-parser surplus into the next stage. Asio has buffered-handshake overloads; discarding a parser-owned tail can lose bytes already read from the socket.

With this simple type, next_layer and lowest_layer both reach TCP. More wrappers can make them different, so choose the interface carrying the proxy's actual wire protocol. An HTTPS proxy adds another TLS stage and is outside this plaintext CONNECT sequence.

Аффингæй хæстæг статьялтæ