Topic cluster
TLS and proxy security
Termination, passthrough, SNI routing, mutual TLS, interception, request smuggling and SSRF, with the configuration and the failure modes for each.
Putting a proxy in the path of encrypted traffic forces a decision: either the proxy holds the private key and can read everything, or it cannot read anything and its usefulness collapses to routing on the parts of the handshake that are still in the clear. Most of the security questions in this cluster follow from that single choice.
The rest follow from a second fact: a proxy is a second HTTP implementation in the path, and two implementations that disagree about the same bytes is the definition of a parsing vulnerability.
Start here by intent#
| You want to | Read |
|---|---|
| Decide where TLS terminates | TLS termination, passthrough and re-encryption |
| Route TLS without decrypting it | SNI-based routing |
| Use client certificates behind a proxy | Mutual TLS through a proxy |
Understand why your corporate laptop breaks pip install | TLS interception and corporate root CAs |
| Know whether your chain is smuggling-safe | HTTP request smuggling and proxy desync |
| Stop your proxy fetching internal URLs on demand | SSRF and the proxy layer |
| Audit an existing deployment | Reverse proxy security checklist |
The recurring theme#
Every page in this cluster ends up at the same rule: a proxy converts an assertion into a fact for everything behind it. It asserts the client IP, the protocol, the hostname, the client certificate identity, sometimes the authenticated user. Whatever it asserts, the application will believe. That is why the trust boundary has to be a real network boundary, enforced by firewall rules and header stripping, and not just a naming convention.
Every guide in this cluster#
- HTTP request smuggling and proxy desyncWhy two HTTP parsers in a chain disagree on message length, the CL.TE, TE.CL, TE.TE, H2.CL and client-side desync classes, and the defences that work.
- Mutual TLS through a proxyVerify client certificates at nginx, HAProxy, Envoy, Traefik and Caddy, forward the identity safely, and avoid the XFCC spoofing hole and TLS 1.3 traps.
- Open proxies and misconfigured relaysThe three ways a proxy becomes open by accident, how scanners find it, what it costs you, and the bind, ACL and CONNECT settings that close it.
- Reverse proxy security checklistAn auditable reverse proxy checklist covering trust boundary, framing, TLS, upstream, rate limits, exposure, logging and process, and how to verify each.
- SNI-based routingHow proxies route TLS connections without decrypting, by reading SNI from the ClientHello: nginx, HAProxy, Envoy and Traefik configs, plus what ECH breaks.
- SSRF and the proxy layerHow a reverse proxy becomes an SSRF weapon, the bypasses an allowlist must survive, and why a locked-down egress proxy is the strongest architectural defence.
- TLS interception and corporate root CAsHow intercepting proxies forge certificates, what that breaks, and the exact trust store fix for curl, Python, Node, Go, Java, npm, pip and Git.
- TLS termination, passthrough and re-encryptionHow the three proxy TLS topologies differ in visibility, certificate placement and client IP handling, with worked nginx configs and decision rules.