OpenSSL s_client: 403-ka proxy-ga wuxuu dhacaa ka hor TLS-ka meesha loo socdo
U fasir 403-ka CONNECT ee proxy OpenSSL inuu yahay guul-darro marxaladda tunnel-ka, hana ku baarin shahaadada meesha loo socdo handshake aan weligiis bilaaban.
Haddii openssl s_client uu helo HTTP 403 jawaabta codsigiisa CONNECT ee proxy-ga, ka bilow diidmadaas. Tunnel-ka la codsaday lama dhisi.
Iyada oo leh -proxy, s_client wuxuu marka hore weydiistaa proxy-ga HTTP inuu ku xirmo meesha loo socdo oo lagu tilmaamay -connect. Kaliya jawaab CONNECT guulaysatay ayaa is-beddelkaas u rogta tunnel loogu talagalay handshake-ka TLS ee meesha loo socdo.
Nidaamkani wuxuu sharraxayaa soo-saaris haddii kale qasan: khalad proxy oo ay ku xigaan cinwaanno la xiriira TLS, shahaado dhinac oo maqan, ama safka xaqiijinta oo u muuqda mid xasilloon. Meelahaas ma caddeeyaan in shahaadada meesha loo socdo la helay oo la xaqiijiyay. Hawlgalku wuxuu joogsaday marxalad hore.
Diiwaangeli jawaabta proxy-ga iyo martigeliyaha iyo dekedda meesha loo socdo ee la codsaday. 403 wuxuu dareenka u jeediyaa go'aanka gelitaanka proxy-ga; 407 wuxuu weydiistaa aqoonsiga proxy-ga. Midkoodna laguma hagaajiyo daminta xaqiijinta shahaadada meesha loo socdo.
Marka la oggolaado in la baaro is-beddelka, soo-saarista -debug ee s_client waxay kaa caawin kartaa in la muujiyo diidmada. Ka hay wax kasta oo aqoonsi proxy ah spoor la wadaago. Tunnel guulaysatay ayaa wali u baahan qiimeyn TLS iyo shahaado u gaar ah ka dib, laakiin ma jiro silsilad shahaado bartilmaameed ah oo la baaro ilaa marxaladdaas si dhab ah loo gaaro.