can your corporate proxy terminate requests for https://registry.npmjs.org ? usually corp proxies do not unless they support something like squid's ssl bump/peak/splice... if not, then ATS will have to send a CONNECT request to your corp proxy(not sure if ATS supports issuing CONNECT to upstream servers)..
try the below curl commands to test your corp proxy. TLS termination.. curl -k -o /dev/null -v --resolve registry.npmjs.org:443:<CORP PROXY IP> https://registry.npmjs.org CONNECT curl -o /dev/null -v -x <CORP PROXY IP>:<PROXY PORT> https://registry.npmjs.org/ does your existing java based proxy support requests for https://registry.npmjs.org ? btw.. you can still inspect the TLS handshake within a pcap. you should also be able to view the TLS alert issued by either side within the same pcap. you can also try placing ATS into debug mode to see whats going on. On Wed, Mar 15, 2017 at 11:47 PM, Jim Groffen <[email protected]> wrote: > Hello, > > I have written a simple proxy in Java to forward requests through the > corporate proxy and access an external site using HTTPS. There is no > internet access unless we go via this corporate proxy. > > I'm now trying to replace my simple proxy with TrafficServer. My setup is > as follows: > > User -> TrafficServer -> Corporate Proxy -> External Site > > I have configured two remap rules (using the NPMJS Registry for testing): > > regex_map http://(.*):8080/npm http://registry.npmjs.org:80/ > <http://registry.npmjs.org/> > regex_map http://(.*):8080/snpm https://registry.npmjs.org:443/ > <https://registry.npmjs.org/> > > I also have configured the corporate proxy as a parent proxy: > > dest_domain=. parent=[corporate proxy ip]:[port] > > With this configuration I can hit the /npm path and traffic comes through > correctly, but when I try the /snpm path I get a "Could Not Connect" error. > > Monitoring the traffic shows that some tcp packets are sent between the > TrafficServer and the corporate proxy, then the corporate proxy returns an > HTTP 400 response. > > Monitoring the Java based simple proxy for comparison, I see the TCP > traffic, then a valid HTTP 200 response. > > I've tried a few things around the SSL settings like relaxing the allowed > ciphers, but it's hard to know what's wrong because the TCP traffic is > likely the encrypted SSL traffic! One interesting point though, I can see > registry.npmjs.org when using TrafficServer - I assume this is due to SNI > (Server Name Indication) - but my Java based proxy doesn't do this. This > made me wonder if SNI isn't supported on my corporate proxy. > > Another possible wrinkle is I need to auth to the Corporate Proxy - I've > enabled proxy.config.http.forward.proxy_auth_to_parent and am using the > headers plugin to provide valid login details - which is all working for > non-https traffic. > > Thank you in advance, any help would be greatly appreciated! > > Cheers, > > Jim >
