Cloud with Proxies - Proof and solution

Question

Hi all,
I've struggled with this issue for a while, and read many similar posts from those having the same issue. I have found a solution that worked for me and hopefully others.
Essentially, although the Application Manager and other utilities appear to function properly inside a corporate network, the "phone home" services fail to connect, and leave you with an "expired subscription" or various messages similar to "You're not connected to the internet" and so on.
Adobe adamantly states that the software is "Proxy-aware" so there must be other unresolvable issues, and you should kindly ask your IT team to deactivate firewalls, proxies, virus-protection, etc... (yea, right...). You could also request adding exceptions to 6 or so activation servers on a range of ports, which still doesn't work, and take 6 months and 5 levels of management approval.
In reality, "proxy-aware" is only partly accurate, as shown in the graphic below. I monitored PDApp.exe (Adobe Application Manager) with the ProcessExplorer tool (Windows, sysinternals) while doing several network-active tasks to see where the traffic was being routed.
So, PDApp.exe gets correctly routed via my proxy server for installing apps, running updates, and logging in to the app when opening it up.
However, when getting "Subscription Expired" and "Unable to connect to the internet" and clicking "Try Again" or "Licence this Software", the proxy is ignored and the app attempts to connect directly to ims-na1.adobelogin.com, which fails.
The worst part of this was I went through the 5 levels of management approval and so on to get the two servers Adobe states you need access to for Cloud added as exceptions to our firewall(https://activate.adobe.com and https://lm.licenses.adobe.com/, on ports 23, 80 and 443), and still got nowhere, because without ims-na1.adobelogin.com, you can't proceed past the screen above.
Now, for my solution:
I searched for software that would force a program to use a specific proxy. I came across lots, I have to experience with these so I can't vouch for any particular one, but I chose "Proxifier". (They have one that doesn't require an installer for those who don't have local admin rights.) This one is a trial, I'm sure there are free ones as well, just search a bit more.
The proxy server address can be deduced from watching working software traffic in Process Explorer (right click on "Internet Explorer" and got to properties, then TCP/IP, I could see the proxy being addressed under "Remote address", as see in the graphics above). Alternatively just ask your IT team.
I won't get into how to set up the software, read it's help files; what you want is to take any communications from PDApp.exe that are NOT already destined to your proxy server's address and send them to your proxy server's address. (this is important - some communications from PDApp are proxy-aware and redirecting them will cause them to fail)
Hopefully this helps a few people. Despite the issues I love Adobe's software, and am happy I am using it again.

Answer 1

Thanks for taking a read Jeff, and passing along the information.
My company uses an ISA proxy server (HTTP protocol)
Like many such systems, ISA server does not allow SSL tunnels to ports other than 443 and 563 by default (PDApp attempts to use ports 80 and 8080). The reasoning is that SSL tunnels bypass security policy rules and inspection and therefore creates a security risk, which is taken quite seriously (especially with a company this size (37,000+). Check out http://technet.microsoft.com/en-us/library/cc302684.aspx for more detail.
As an addendum to the initial post, it is critical that the IT team allows SSL tunnels to the required ports. I hadn't noticed this originally as the policy was adjusted to allow access to the addresses Adobe originally provided.
I might add a disclaimer that the software mentioned above and similar can also be used to try and circumvent a company's internet security policies, so make sure you can demonstrate that it is being used to force the proxy server rather than avoid it!