For context, i am using nginx's reverse proxy ngx_http_proxy_module to cache content from an upstream https server. For a specific project, i need nginx to pass through a corporate HTTP proxy (using the HTTP CONNECT method), and unfortunately this is not supported by nginx (and not planned either). Additionnaly, this project requires the connection to the proxy to be over SSL/TLS.
To work around this, i found a related question on stackoverflow which suggests to run socat as forwarder with the PROXY feature below, and have nginx use it as upstream server.
socat TCP4-LISTEN:8443,reuseaddr,fork PROXY:yourproxy:backendserver:443,proxyport=<yourproxyport>
The man page of socat states:
PROXY:<proxy>:<hostname>:<port>
Connects to an HTTP proxy server on port 8080 using TCP/IP version 4 or 6 depending on address specification, name resolution, or option pf, and sends a CONNECT request for hostname:port. If the proxy grants access and succeeds to connect to the target, data transfer between socat and the target can start. Note that the traffic need not be HTTP but can be an arbitrary protocol.
Option groups: FD,SOCKET,IP4,IP6,TCP,HTTP,RETRY
Useful options: proxyport, ignorecr, proxyauth, resolve, crnl, bind, connect-timeout, mss, sourceport, retry
See also: SOCKS, TCP
In other terms, this works with http proxies, except that the PROXY feature of socat does not support SSL/TLS (i.e. it cannot use an https proxy, only a plain http proxy), which is required among several professional environments nowadays.
Keeping in mind that i cannot easily swap nginx for something else, is there a way to turn the socat-> proxy connection over TLS, not involving writing a custom socat alternative ? Are there any alternative tools that can achieve this ?
