I have a Linux appliance running on CentOS and I would need it to go through our proxy for CRL lookups. I want to set the http_proxy variable but my question is whether I should use http_proxy or https_proxy or does it depend on the type of traffic ? As far as I know, CRL lookups are processed via http. thx
These proxy types have different behavior.
The client send a specific http request (i.e.
CONNECT) to https proxy server, which builds a tunnel to the destination server and forward the TCP connection.
Then the client sends SSL/TLS request to the server, there is SSL handshake and once the connection has been established by the server, the proxy server continues to proxy the stream to and from the client.
http proxy simply gets a plain-text request from the client and forward the http request to the destination server and then returns information to the client.
If you send/receive sensitive data, https proxy is what you want to use, but if not, http is faster and does not require an encrypted traffic.
For CRL lookups
http_proxy is right, CRL is a public domain object and contains non-privacy information. Moreover, you need to download CRL to decide which sites have a valid SSL certificate, so doing SSL handshake to get CRL seems illogical to me.