Verify intercepted upstream certificates #48

Merged

mikluko merged 1 commit from feat/verify-upstream into main

2026-10-26 22:24:42 +00:00

mikluko commented

2026-10-26 22:23:23 +00:00

Owner

Candidate 6 of the architecture review, together with the upstream verification gap.

handlers.DefaultTransport set InsecureSkipVerify, so on an intercepted connection a client trusting multiproxy's CA could not tell a forged upstream from the real one.

handlers.DefaultTransport verifies against the system roots, and a failed verification answers 502 Bad Gateway instead of 500.
proxy.Config.Transport makes the upstream transport a declared seam.
-upstream-ca <file> trusts a private CA beside the system roots, and -upstream-insecure restores the old behaviour. The two are mutually exclusive.

Tunnelled and plain-HTTP traffic is unaffected.

Breaking: an intercepted host with a self-signed or private-CA certificate now gets 502 until one of the flags is added. The changelog marks it.

Tests that intercept httptest servers now trust the certificate those servers share, through their Client().Transport, instead of relying on the insecure default. The router's routing test reaches its upstream as localhost, which that certificate does not name, so it skips verification with a comment saying why. New tests cover the 502 on an untrusted upstream, a trusted one, both flags, and the flag errors.

Smoke run: intercepting https://example.com through the binary with default verification returns 200. The reference, the interception how-to and the explanation page are updated. The suite passes three times in a row under -race.

Candidate 6 of the architecture review, together with the upstream verification gap. `handlers.DefaultTransport` set `InsecureSkipVerify`, so on an intercepted connection a client trusting multiproxy's CA could not tell a forged upstream from the real one. - `handlers.DefaultTransport` verifies against the system roots, and a failed verification answers `502 Bad Gateway` instead of 500. - `proxy.Config.Transport` makes the upstream transport a declared seam. - `-upstream-ca <file>` trusts a private CA beside the system roots, and `-upstream-insecure` restores the old behaviour. The two are mutually exclusive. Tunnelled and plain-HTTP traffic is unaffected. Breaking: an intercepted host with a self-signed or private-CA certificate now gets 502 until one of the flags is added. The changelog marks it. Tests that intercept `httptest` servers now trust the certificate those servers share, through their `Client().Transport`, instead of relying on the insecure default. The router's routing test reaches its upstream as `localhost`, which that certificate does not name, so it skips verification with a comment saying why. New tests cover the 502 on an untrusted upstream, a trusted one, both flags, and the flag errors. Smoke run: intercepting `https://example.com` through the binary with default verification returns 200. The reference, the interception how-to and the explanation page are updated. The suite passes three times in a row under `-race`.

mikluko added 1 commit

2026-10-26 22:23:24 +00:00

Verify intercepted upstream certificates

CI / changelog (pull_request) Successful in 5s

Details

CI / test (pull_request) Successful in 1m0s

Details

bd0611727f

handlers.DefaultTransport skipped TLS verification, so a client trusting
multiproxy's CA could not tell a forged upstream from the real one. It now
verifies against the system roots, and a certificate that does not verify
answers 502 instead of 500. proxy.Config.Transport makes the upstream
transport a declared seam; -upstream-ca trusts a private CA and
-upstream-insecure restores the old behaviour.

Tests that intercept httptest servers trust the certificate they share
instead of relying on the insecure default.

mikluko merged commit 000298d5ed into main

2026-10-26 22:24:42 +00:00

mikluko referenced this pull request from a commit

2026-10-26 22:24:42 +00:00

Merge pull request 'Verify intercepted upstream certificates' (#48) from feat/verify-upstream into main

mikluko deleted branch feat/verify-upstream

2026-10-26 22:24:43 +00:00