0

I have a Linux appliance running on CentOS and I would need it to go through our proxy for CRL lookups. I want to set the http_proxy variable but my question is whether I should use http_proxy or https_proxy or does it depend on the type of traffic ? As far as I know, CRL lookups are processed via http. thx

  • set both if you are not sure. – Ipor Sircer Oct 26 '16 at 14:52
  • well, that's an option for sure, but what is the decision based on, whether to use http_proxy vs. https_proxy ? On the type of traffic that needs to be proxied ? – cyzczy Oct 26 '16 at 15:06
0

These proxy types have different behavior.

https proxy:

The client send a specific http request (i.e. CONNECT) to https proxy server, which builds a tunnel to the destination server and forward the TCP connection. Then the client sends SSL/TLS request to the server, there is SSL handshake and once the connection has been established by the server, the proxy server continues to proxy the stream to and from the client.

http proxy:

http proxy simply gets a plain-text request from the client and forward the http request to the destination server and then returns information to the client.

If you send/receive sensitive data, https proxy is what you want to use, but if not, http is faster and does not require an encrypted traffic.

For CRL lookups http_proxy is right, CRL is a public domain object and contains non-privacy information. Moreover, you need to download CRL to decide which sites have a valid SSL certificate, so doing SSL handshake to get CRL seems illogical to me.

  • wait a minute, so does that mean that if i set the variable my CentOS will act as a proxy server? I'm somehow confused. I need my CentOS box send data TO a proxy server in my environment (similar like setting proxy settings in IE). Will this do the trick? – cyzczy Oct 27 '16 at 7:00
  • @adam86 No, when setting your variable with a command like export http_proxy="http://yourproxyserver:port", your centOS won't act like a proxy server but it will know how to properly connect to your http proxy server, as it happens when setting a proxy in IE. – andreatsh Oct 27 '16 at 9:10
  • Thank you! I really appreciate your help! One last question. Do I have to put http:// or is it fine to use export http_proxy=10.0.0.1:8080 in case no authentication is required? – cyzczy Oct 27 '16 at 9:40
  • @adam86 Yes, in your case you should set http_proxy=http://10.0.0.1:8080. – andreatsh Oct 27 '16 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.