The browser security warning you are getting is because of the host name mismatch in the url and in the server certificate (e.g. localhost
vs. example.com
).
To make the forwarding work without this warning you need to put the forwarder on the same TCP port and override DNS resolution for the effected domain (i.e. make example.com
resolve to 127.0.0.1
).
The simplest approach is as follows:
edit your hosts file and add example.com
domain to the localhost line (sort of howto is here)
start your forwarding (beware that you need to use server IP address and not domain name as the domain name is already redirected to localhost)
socat TCP-LISTEN:443,fork,reuseaddr TCP:123.456.789.12:443
check it is working in the browser via https://example.com
Do not forget to remove the domain entry from the hosts file when done experimenting.
If you can't ensure the same TCP port number, this approach might work as well -- but only under some conditions:
the site is using relative paths in links (as an absolute path would use original (thus different) port number)
there is no port number written in the server certificate (which is usually not the case)
Note: It is possible to setup a MITM socat proxy, but this would require adding an artificial trusted CA.
Good luck!
socat
, but onesocat
and Firefox. So I don't understand that recipe...https
-requests from Firefox (viasocat
) to remote server.ssl
connection should be between Firefox and server,socat
is just a redirector, nothing more. When I try this commandsocat TCP-LISTEN:8081,fork,reuseaddr OPENSSL:123.456.789.123:80,verify=0
, I got an error "error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol".socat
process, not two ones.Firefox
->socat
->server
.