SSL exception when trying to proxy https about wiremock

[tomakehurst]

Do you have browser proxying enabled? If so, then unfortunately it's not possible to do https proxying.

[SvenSchindler]

Thank you very much for your fast response. Actually we do have browser proxying enabled. We are trying to mock some request caused by webdriver running firefox. I'm not an HTTPS/SSL/TLS expert so this question may sound stupid but isn't it possible (or can it be implemented) to let wiremock run as an HTTPS proxy like squid so that it has an own key pair and basically simulates an HTTPS server? Then wire mock would be able to decrypt the requests and can even mock some of the requests. This should work for unverified requests, right? Thanks again.

[tomakehurst]

You can set wiremock up to transparently proxy, either by adding a proxy mapping or starting it with --proxy-all. That way you'll have separately encrypted conversations between your client-> wiremock and wiremock->backend. The reason browser proxying doesn't work is that the browser tries to use the CONNECT method, which doesn't involve decryption.

[SvenSchindler]

Uh, I didn't know how the communication between browser and proxy works in case of HTTPS. That explains a lot, thanks.

[fengverson]

Hi tomakehurst,

I am planning to migrate betamax to wiremock for record and replay purpose. Betamax basically plays as middle man between client and service however, it doesn't have support for https proxying. I realized wiremock didn't solve this problem directly as well. Instead wiremock create separate conversation between client -> wiremock and wiremock -> service. so my question is that when you create wiremock, the reason you design this way is to avoid https proxying issue? I am not familiar with HTTPS. Is this the only way to solve https record and replay issue?

Thanks,

[tomakehurst]

Unfortunately, the decrypt + re-encrypt approach is the only viable option for HTTPS, the reason being that WireMock needs to see the contents of the request in order to decide what to do with it.

Some proxy servers are able to act as pass-through HTTPS proxies, but they do this via the CONNECT HTTP method, which essentially turns them into TCP proxies (which means they don't need to see the request's contents, just the target IP address).