bryancall commented on issue #11543: URL: https://github.com/apache/trafficserver/issues/11543#issuecomment-4828155617
I am closing this out as a stale support question. What you are asking for is for Apache Traffic Server, acting as a reverse proxy, to take a plain HTTP request, remap it to an HTTPS origin, and then reach that origin by tunneling through your corporate forward proxy with an HTTP CONNECT. Traffic Server does not do that. When a parent is configured with parent_is_proxy=true, Traffic Server forwards the request to the parent as an ordinary proxy request; it does not synthesize a CONNECT to establish a tunnel for an HTTPS origin. Your debug log shows exactly this: Traffic Server resolved the corporate proxy address and then attempted a direct TLS handshake against the proxy (the call to sslNetProcessor.connect_re), which failed immediately with a connection error, because the corporate proxy is not itself the TLS endpoint for download.docker.com. The CONNECT path in Traffic Server only engages when the client itself sends a CONNECT request, which is the approach Miles suggested earl ier in the thread (using curl with the proxy and CONNECT options so the client initiates the tunnel). You noted that changing the client side is not an option for you, so there is no supported configuration that does what you want here. As a separate note, Masakazu asked whether you were on OpenSSL 3.2 or newer, in which case the outbound TLS failure could have been the unrelated bug tracked in https://github.com/apache/trafficserver/issues/11465 (now fixed); that was never confirmed. Since this is a configuration and feature question rather than a defect, and the thread has been inactive long enough to be marked stale, I am closing it. If you do want Traffic Server to learn to tunnel HTTPS origins through an upstream forward proxy via CONNECT, please open a feature request describing that use case and we can discuss it there. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
