Open cfiehe opened 1 month ago
Think you'd need the CONNECT to be initiated by the client like curl -p -v -x 127.0.0.1:8080 https://download.docker.com/linux/ubuntu/
(and I think you'd do the mapping like map https://download.docker.com https://download.docker.com:443 )
Yes, when the client addressing scheme could have be modified, it would work, unfortunately, that is not the case. The example above should just reflect the use case. I have to find a solution hat allows to reverse proxy a resource that is only reachable via a forward proxy and requires HTTPS, but the incoming request is plain HTTP. Also sending a redirect to tell the client to use HTTPS is not an option.
Think your next debugging step would be to get on the node running ATS, and find a (verbose) curl that works -- that should help in figuring out how to mimic the curl with ATS config.
@cfiehe Do you use OpenSSL 3.2+ by any chance? If you do, the cause can be https://github.com/apache/trafficserver/issues/11465.
I try to map a plain HTTP request from a client to a HTTPS destination using:
The mapping itself is working and the URL is rewritten, but the request fails with:
ATS cannot access the resource directly, the request must pass our corporate proxy. I have defined a corresponding parent proxy definition:
When I use HTTP instead of HTTPS in the destination URL of the mapping rule, it is working. It seems to me, that ATS does not use the CONNECT method in order to establish a connection to the destination via the corporate proxy.
I have turned on debug logging, but I am not sure, if it helps to narrow down the issue:
Has anybody an idea, how to solve the issue?