Prevent HTTPS proxy from intercepting SSL traffic

We have a Flex + BlazeDS+Spring application built which runs on WebSphere6.1.
We use the AMF secure protocol (SSL) for Communication. Inspite of using SSL ,tools like charles proxy are able to decrypt
the communication and debug the AMF messages. How can we prevent the HTTPS proxies like charles proxy to avoid such Interceptions.

Got it working ...

Similar Messages

[SOLVED] How cat I make an http proxy from ssh?

Hi.
I can tunnel to ssh server using this:
ssh -N -D $myport $user@$serverip
It's working good. I tunneled to the server.
But I have a problem!
the created proxy is a Socks v5 proxy. I want to create a http proxy how can i do it?
Thanks! I waiting for your answers...
Last edited by ojZim (2013-05-26 17:55:36)

Gusar wrote:
You can't. What you can do is run a local http proxy that uses the ssh-created Socks5 as parent. Example config for polipo:
daemonise=true
proxyAddress=127.0.0.1
proxyName=localhost
allowedClients=127.0.0.1
socksParentProxy=localhost:7777
socksProxyType=socks5
7777 is an example, use $myport there. The default polipo port is 8123, meaning apps should be configured to use localhost:8123 as proxy.
Thanks for your help! It's worked very good and my problem is solved.
For installing and configuration polipo, other users can read this:
https://wiki.archlinux.org/index.php/Polipo
Last edited by ojZim (2013-05-26 17:56:39)

Prevent HTTP errors from popping up

I am using HTTP to pull back some optional data in a flex application. I created the HTTP connection by using the Connect to HTTP from the Data menu. Sometimes the service is available, sometimes it is not. Sometimes the data is well formed, sometiems it is not. I essentially want to "swallow" all of these errors and not have them turn into a modal error dialog or a stack trace when the service isn't available or returns malformed XML. Is there a way to prevent the default behavior of presenting those errors to the user?
Thanks.

Hi,
@broconne
if you used built-in service call generation (data management -> generate service call) then you could have something like below lines in your code:
<s:CallResponder id="Operation1Result"/>
          <myservice:MyService id="myService"
                                    fault="Alert.show(event.fault.faultString + '\n' + event.fault.faultDetail)"
                                    showBusyCursor="true"/>
By default Flash Builder inserts fault handler wired to Alert to show you what went wrong. If you have generated code similar to above you could read that docs page that details what code is generated, with description of individual object responsibilities and on how to modify that code to fit your specific requirements:
http://help.adobe.com/en_US/Flex/4.0/AccessingData/WSbde04e3d3e6474c4-56c6d6d11210238e6e8- 8000.html
(yes, in you case do not handle fault event with alert, you could simply handle it during debugging phase only - but some error handling is required when providing to end-users I think),
regards,
Peter

HTTP Proxy setting for SOA server

Hi,
my intention is to enable SOA Server to connect through HTTP Proxy to external services. This occurred when I am trying to connect to Yahoo Mail Server, via User Messaging Service but it keep throwing connection time out. One of the possible solution is to make the service to connect via the HTTP Proxy server in our network.
There are no mention of how to setup HTTP Proxy connection for UMS, as well as SOA Server in any documents.
Please advice or direct me to the relevant solutions.
Appreciate any help rendered :)
yee thian

I have not worked in SoA server, but since it uses weblogic server underlying (I assume), you can try setting the -Dhttp.proxyHost , -Dhttp.proxyPort system properties ( https for secured URL's) to WLS to specify the proxy details. Also the product might not have the capability to pass user credentials for authentication at the proxy. The version of OSB we are using had this problem. To overcome this you might require to add the URL to the proxy free list in your proxy server. This prevents the proxy from prompting for the user name when you access that URL.

Http proxy setting for webservice client.

Hi !
I have set the following option for accessing the webservice through the proxy(webservice
outside the firewall).
I'm using weblogic v7.0 with sp1.
-Dweblogic.webservice.transport.http.proxy.host=xxxx
-Dweblogic.webservice.transport.http.proxy.port=8088
It works fine and my soap client is able to access the webservice lying outside
the firewall.
But when I use the same setting, the soap client fails for accessing the webservice
which are
inside the firewall.
I get "Connection refused".
Is there any option to specify not to use proxy for specific hosts and ports ?
For example http.nonProxyHost
Any pointers will be of great help.
Thanks
Kumar Raj

I have not worked in SoA server, but since it uses weblogic server underlying (I assume), you can try setting the -Dhttp.proxyHost , -Dhttp.proxyPort system properties ( https for secured URL's) to WLS to specify the proxy details. Also the product might not have the capability to pass user credentials for authentication at the proxy. The version of OSB we are using had this problem. To overcome this you might require to add the URL to the proxy free list in your proxy server. This prevents the proxy from prompting for the user name when you access that URL.

Http proxy setting

Hi everyone,
I'm new to the forum but not new to Blackberry family. Currently am an proud owner of a bb z10 and runnng latest 10.2.1 this update rocks that is all i have to say but ofcourse there are some improvements need to be done.
Anyway, what i wanted to do is to setup a http proxy settings on my z10 (when using my data service LTE on FIDO) like how it is done on BB playbook (WIFI then add my proxy information). Is there somewhere on the phone setting i can do this or a thirdparty software to achive this. Oh, by the way my phone is unlocked if you wondered.
Thanks for reading.
"BlackBerry: For Getting Things Done (TM)"

I have not worked in SoA server, but since it uses weblogic server underlying (I assume), you can try setting the -Dhttp.proxyHost , -Dhttp.proxyPort system properties ( https for secured URL's) to WLS to specify the proxy details. Also the product might not have the capability to pass user credentials for authentication at the proxy. The version of OSB we are using had this problem. To overcome this you might require to add the URL to the proxy free list in your proxy server. This prevents the proxy from prompting for the user name when you access that URL.

Web service client ignores http proxy settings

I have a web service client using Weblogic's web service client library. I'm trying to instruct it to use a http proxy. I've set all the following system properties:
-Dhttp.proxyHost=127.0.0.1
-Dhttp.proxyPort=8080 -Dweblogic.webservice.transport.http.proxy.host=127.0.0.1 -Dweblogic.webservice.transport.http.proxy.port=8080
No traffic is passing through the proxy.
When the proxy is down, the application works fine too. I suspect that the proxy settings are completely ignored for some reason.
I'm using Weblogic 8.1 SP4 on a Windows XP box and JDK 1.4.2 (Sun's bundled JDK with Weblogic).

Sorry about the delay,
You just need to use the standard java http proxy properties, take a look at:
http://download-west.oracle.com/docs/cd/A97329_03/web.902/a95453/useservices.htm
Does this help?
Gerard

Cisco CSS as non-HTTPS SSL-traffic terminator

Hi!
Does anybody know is it real to use Cisco CSS as SSL-traffic terminator. I need to terminate non-HTTPS SSL-traffic on this device (i.e. SSL-encrypted sessions of any particular TCP-based application-layer protocol, not https)? If not, is there any CISCO device capable of doing such a job?
Regards, Amir

Hi!
Thank you very much for your reply.
I know about the S model - as per my post - but unfortunately I have realized after making the purchase.
Can you please help me with the following issue: my unit is not able to boot from FTP, even if I follow up the CISCO official documentation for that version (I issue all the commands as in the manual). More than that, if I setup the Primary Boot Configuration and then I want to check it up there is nothing in that field. The Secondary Boot Configuration keeps its settings and after the Primary failure it will try the Network Booting but with Failed status - returning me to the OffDM.
I mention that I am using the OffDM because the unit I bought has no Flash Card.
Also I am not sure how can I have a "network mounted filesystem" and in the meantime to use the FTP protocol; setting up a NFS server wont provide me with Windows style absolute path like k:/.... as per CISCO official guide. Is that a plain-ftp generically called as Network File System??? "First, create these subdirectories on the FTP server, then copy the files from the boot image to the subdirectories"
Is this linked with the fact that I am using a Linux box for my FTP Server? Can you please help me to understand what the following line from CISCO official guide means "A network boot is not supported on UNIX workstations"
Thank you!

A fix for the Mozilla Firefox SSL Certificate Validation Security Weakness vulnerability? This appears to be an issue with not revalidating certificates when loading HTTPS pages from cache.

We have to close vulnerabilities for PCI & Cybertrust certification. We have upgraded users running Firefox to version 7.0.1 but we are still receiving the message: Mozilla Firefox SSL Certificate Validation Security Weakness. Researching the issue, it appears to be related to certificates not being revalidated when loading HTTPS pages from cache. The bug report I found is:
Bug 660749 - Firefox doesn't (re)validate certificates when loading a HTTPS page from the cache

cookies.squite answer is Today at 5:15 PM .
New profile, same problem.
We've already established it is not a add-ons problem but obviously there will be less add-ons in this new profile to help exclude.
Since there is two PC profiles on the PC, I tried the second profile, same problem. Used the RESET FF function on the second PC profile...same thing...even followed the instruct for uninstall &re-install...same problem.
(3) different virus scanners, no hard core problems.
Suspect how I have something in Windows setup that no one else is using?

WWSAPI - Cannot connect to web service via SSL and HTTP proxy authentication with NTLM, errorCode 0x803d0016, HTTP status 407

Hi,
I built a web service client using WWSAPI. The connection works via SSL (without HTTP proxy) and it works with SSL and proxy with basic authentication as well. When I try to connect using a proxy with NTLM authentication, then I get the errorCode
0x803d0016, HTTP status "407 (0x197)", "Proxy Authentication Required".
In WireShark I see only one HTTP request to connect to the proxy with NTLM Message Type: NTLMSSP_NEGOTIATE. The HTTP Response returns Status 407 and the connection ist closed. Comparing this to Internet Explorer - the Connection is not closed and
a second request with NTLMSSP_AUTH is sent.
Why doesn't it make the complete NTLM handshake? Why wasn't sent the NTLMSSP_AUTH directly?
I oriented in the HttpCalculatorWithKerberosOverSslClientExample.
Using WS_HTTP_HEADER_AUTH_SECURITY_BINDING,
WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_SCHEME was set to WS_HTTP_HEADER_AUTH_SCHEME_NTLM, WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_TARGET to WS_HTTP_HEADER_AUTH_TARGET_PROXY. I tried WS_DEFAULT_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE but also WS_STRING_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE.
Any idea?
Thanks

Hi,
I built a web service client using WWSAPI. The connection works via SSL (without HTTP proxy) and it works with SSL and proxy with basic authentication as well. When I try to connect using a proxy with NTLM authentication, then I get the errorCode
0x803d0016, HTTP status "407 (0x197)", "Proxy Authentication Required".
In WireShark I see only one HTTP request to connect to the proxy with NTLM Message Type: NTLMSSP_NEGOTIATE. The HTTP Response returns Status 407 and the connection ist closed. Comparing this to Internet Explorer - the Connection is not closed and
a second request with NTLMSSP_AUTH is sent.
Why doesn't it make the complete NTLM handshake? Why wasn't sent the NTLMSSP_AUTH directly?
I oriented in the HttpCalculatorWithKerberosOverSslClientExample.
Using WS_HTTP_HEADER_AUTH_SECURITY_BINDING,
WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_SCHEME was set to WS_HTTP_HEADER_AUTH_SCHEME_NTLM, WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_TARGET to WS_HTTP_HEADER_AUTH_TARGET_PROXY. I tried WS_DEFAULT_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE but also WS_STRING_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE.
Any idea?
Thanks

[SOLVED]JDeveloper 10g and ADF: How to create proxy from WSDL behind SSL?

Hi all,
I have successfully created web service proxies using the "Create Web Service Proxy" wizard. However, when I attempt to generate proxy from a wsdl file behind a ssl connection, JDeveloper throws a "SSLHandshakeException". I have a working java keystore file which was verified by using the soapUI tool. Within the soapUI tool, there is a "SSL Settings" preference tab which allows me to point to a *.jks file/password. I tried looking for a similar setting in JDeveloper preference with no luck. Is anyone familiar with this type of request?
Many thanks,
Wes
Edited by: Wes Fang on Sep 21, 2010 10:25 AM

add certificate to java keystore with something similar to the following:
C:\jdev10134\jdk\jre\lib\security>keytool -import -trustcacerts -file MYCERTIFICATE.cer -alias MYCERTIFICATEALIAS -keystore cacerts
Enter keystore password: *******
Certificate already exists in system-wide CA keystore under alias <MYCERTIFICATEALIAS>
Do you still want to add it to your own keystore? [no]: yes
Certificate was added to keystore
The reason it said certificate already exist is because I also added it to the JAVA_HOME\ path.
I restarted jdeveloper and used the proxy generation wizard again, everything worked fine.

Proxying from FMS to HTTP stops working after a few hours

Hi,
I'm using FMS Streaming 3.5.0 r405 on linux servers to stream videos with RTMP/RTMPT. We have decided to use the new proxying function to redirect HTTP requests to a Web server. We did not install the included Apache server, but used a lighttpd server installed on the same machines and configured to listen on port 81. So when a client connects with our player, it tries first RTMP, RTMPT and if it times out on these attemps, we try to go through with HTTP. FMS proxies the HTTP request received on port 80 to the lighttpd server on port 81.
My fms.ini file contains:
# Whether to start and stop the included HTTP server along
# with FMS.
SERVER.HTTPD_ENABLED = false
# IP (address and) port that Flash Media Server should proxy
# unknown HTTP requests to. Leave empty to disable proxying.
# With no address, specifies a localhost port.
# For example:
# HTTPPROXY.HOST = webfarm.example.com:80
HTTPPROXY.HOST = :81
This works well, but after a few hours, the HTTP proxy of FMS does not work anymore. Lighttpd is still responding on port 81. There is no error in all log files. Just stops working!
I have to restart FMS to enable again the tunnel. This behavior happens on all my streamers. Is it a bug or am I missing something?

Hi,
This is what I'm getting when using "ldd fmsedge"
root@wis-fms fms]# ldd fmsedge
linux-gate.so.1 => (0x006ba000)
libpthread.so.0 => /lib/libpthread.so.0 (0x00a67000)
libasneu.so.1 => not found
librt.so.1 => /lib/librt.so.1 (0x0012a000)
libdl.so.2 => /lib/libdl.so.2 (0x00a61000)
libcap.so.1 => /lib/libcap.so.1 (0x00688000)
libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x00cc5000)
libm.so.6 => /lib/libm.so.6 (0x00a38000)
libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x00c3b000)
libc.so.6 => /lib/libc.so.6 (0x008f3000)
/lib/ld-linux.so.2 (0x008d5000)
[root
Alon

Using reverse proxy and terminating ssl on them

Hello
I am trying to set up IAS 9.03 on 2 machines one holding the infrastructure and one holding the midtier.
We want to terminate the ssl traffic on reverse proxys on apache. I am not very good at this so i am looking for a solution i read that you can do this in the whitepapers on the subject IAS.
Much thanks for any answer.
Boris

1) So initially we had the following:
<Object name="reverse-proxy-/">
Route fn="set-origin-server" server="http://server-backend"
</Object>
... and when getting a 401 from the back-end server it would seem that entering credentials in the dialog prompt does not work as is OOB; had it worked we would not have attempted anything further and hence this post would not exist... if we directly access the back-end server our credentials work so that is not the issue.
2) I agree that the "set-basic-auth" directive should be removed - as it is clearly to supply a user id and password - what was provided was a far fetched attempt to get this to work and will clearly remove it as well as the "forward-proxy-agent" and "forward-proxy-auth"
When you configure Web Server 7.0 as a reverse proxy, basic auth should work out of the box. If it doesn't, I recommend looking at the HTTP messages to figure out what's gone wrong. If you don't know how to do that and you have a support contract, Sun support should be able to help you.That is interesting - is this OOB feature documented anywhere?
I'll turn up the log level on the RP and see what happens - if I turn it high enough should I be able to see the request headers being forwarded; I'll also try to look at the backend server logs. Is there anything else you suggest - i.e. should be trying to snoop the traffic....

How to do Handshake with tired party(bank) HTTPS URL from SAP PI server

Dear Expert,
I have developed bunch of scenarios, all are synchronous ABAP proxy to HTTP_AAE with bank on PI 7.4(dual stack). Bank web server is HTTPS enabled server. Our ABAP developments are still in progress also we have few issue in connection from ECC to PI.but that is not the focus of discussion here.
we want to do the handshake to check the connectivity with bank on their HTTPS URL from PI. Bank has provided the privet key for SSL from their server and corresponding public key they have maintained on their server. I have imported the private key under NWA -> Certificates -> Key Storage -> TrustedCA->Import Entry->Entry Type->PKCS#12->select the SSL.p12 file->import , also I have selected the option to "Use SSL" in HTTP_AAE receiver communication channel and selected the corresponding entryin "keystore view" and "keystore entry". All these I have done in our DEV system, and we are trying to connect our PI dev to bank Dev server.
Questions
Is there any specific steps to do the handshake with third party HTTPS(bank in my case) server? if not, how can we just test the HTTPS connectivity by using the SSL private installed on our PI server, without running the complete scenarios. Our PI has been installed on UNIX, and "telnet https url 443" is working, as network team has opened the HTTPS port.
We have not enabled the SSL technically on our PI server, and we have not installed any generated certificate from our PI server. Moreover, we have not made our PI url as "https:hostname:port" as we just need to communicate with bank by using their private key. Do you guys think we should enable the SSL? if yes, please explain why.
What is the best practice to test the connection with third party having HTTPS URL? how can I just assure HTTPS communication is working fine, before testing my actual scenarios.
Thanks for helping always.
Regards,
Farhan

Hi Farhan,
Some part of the blog is applicable for sending HTTPS request to partners/third party (Receiver SOAP Adapter).
If banks certificates are already in trustedCA, then, can you check if it also imported under user PIISuser under Identity management in NWA. If above 2 steps are done then i think your are good to go. But be careful when you install certificate, it should be in proper order.
As you already mentioned, connectivity is already established and you are able to PIng/telnet from pi server, connectivity looks ok.
While sending request, if you are getting 401 unauthorized, below might be the reason -
1. Certificate not installed correctly or some missing steps
2. Partner or TP is not ready to receive it, some certificate issue in there side.
other than 401 means you are ok (As per certificate and Connectivity) - 403 and 500 errors are next stops.
403 - error because of encoding method.
500 - data issue.
Regards
Aashish Sinha

How to establish an Https connection from a html client

Hi! I�m totally new to Java so my question is rather"stupid". I have an html page that sends a post to a servlet
<form name="form" action="servlet/ServletLogOn" method="post">
I want to establish an https connection between the client and the servlet. How is it?
Thanks in advance.

Ignore the previous poster's reply - he was obviously mislead by my original post re: JSSE.
How you install an SSL certificate on your webserver is completely dependent on the webserver you are using. Ususally there is some functionality for doing this from the administrative interface - usually involves pasting some text from the CA's (certificate authority, e.g. Verisign) site into a text box and designating a port number for SSL traffic (use 443, it's internet standard). I've actually only done this for Netscape Enterprise Server - you may want to find a forum for users of your webserver to ask for specifics.

Prevent HTTPS proxy from intercepting SSL traffic

Similar Messages

Maybe you are looking for