Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Failed to verify Certificate when not using localhost as proxy destination #2

Closed
PMFRTT opened this issue May 23, 2023 · 2 comments
Closed

Comments

@PMFRTT
Copy link

PMFRTT commented May 23, 2023

When running in docker, the proxy destination will never be localhost. but rather a destination inside the local network.
When adding a destination, where the proxy address has self-signed SSL enabled, like so:
image
and the certificate is only valid for localhost:
image
is there any way to skip the validation of the local certificate in Zoraxy?

Whenever i try to configure a proxy host this way, i get the following error in my Browser:
image

The log of Zoraxy gives me the following error:
image

Any help with this issue would be greatly appreciated!

@tobychui
Copy link
Owner

I think this would be a complicated issue to solve. I see there are similar issues with apache proxy_http module as well (with docker environment, mostly).

The easiest way to solve this issue is adding a CA to your environment manually. This will trick the system to think that your cert is valid and Zoraxy will continue processing the proxy request.

The current way Zoraxy proxy https is using the http.Hijacker method in http.Server package. If a validation bypass is needed, I guess I might need to rewrite the whole HTTPS proxy logic to allow transporter to skip TLS verification. I will see how could I deal with this after the major functions are completed.

@tobychui
Copy link
Owner

Issue fixed in v2.6.1. You can find the option under "Create Proxy Rules" > Advance Settings > Ignore TLS/SSL Verification Error
圖片

Though, I do not recommend this for the following reasons.

  1. If you are setting up your servers in a trusted network (e.g. home network), you don't need https
  2. If you are setting up your proxy to point to a remote address, a valid certificate is always recommended for security reasons
  3. If you want to self-sign a cert for your domain, you should setup a custom CA that verify your certificate on your reverse proxy host environment instead of bypassing the error

But still, the options are here so if you need it for testing anything, you can feel free to use it with your own risk.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants