Proxomitron Reborn

[amy]

Proxomitron Reborn 4.7.0.1 has been released with a few changes:

- Fix certificate generation
A few sites you reported here weren't working due to OpenSSL 3's stricter certificate parsing (this is actually another discernable difference between OpenSSL and browser's SSL clients). It was happening with very low probability depending on the hostname, so I didn't catch it earlier. Note that in the future, you can enable "Misc. information" in the Log Window to see more details about certificate generation information and errors.

- Show SslCiphers and ServerCiphers in status page
Requested by whenever.

- Attempt to load OpenSSL 3.x before 1.x
Requested by whenever.

- Edited documentation
Updated the configuration dialog pages as remarked upon by whenever.

(Apr. 09, 2024 01:20 PM)DullFace Wrote:  

(Apr. 09, 2024 03:08 AM)amy Wrote:  it just closes the connection without replying with any data.

I tried to play with OpenSSL 3.2.1:

>openssl s_client -connect archive.ph:443
It connects to 90.156.209.190, shows some info and i able to enter something.
Entering "R" gives "RENEGOTIATING", OpenSSL stops accepting input and connection closes after some timeout (not 7200 seconds).
No reaction on input like "GET / HTTP/1.0".

>openssl s_client -connect archive.ph:443 -fallback_scsv
That option makes difference: when i'm entering "GET / HTTP/1.0", "Host: archive.ph" and empty line, it returns headers with html page and closes connection.

Thanks for figuring out the difference. Adding that fallback_scsv at the right time is not something that using OpenSSL makes it easy to do, unfortunately, and so is another difference that can be used to distinguish Proxomitron from a browser. I am thinking of a solution to this and the other discrepancies, but it won't be easy.

(Apr. 13, 2024 01:26 PM)whenever Wrote:  What about showing the adopted values of ServerCiphers and SslCiphers in the "SSL/TLS Information" section of https://local.ptron/.pinfo/ssl/? That way we can know if user defined or default settings are applied depending on if there are errors in user defined settings.

Added to 4.7.0.1.

(Apr. 13, 2024 01:26 PM)whenever Wrote:  Also, is ServerCiphers applied to the built in https server? Is below expected with the default setting?

Yes. I'm not sure how schannel's ciphersuite lists work, but they might not be the same as what OpenSSL accepts.

(Apr. 13, 2024 01:26 PM)whenever Wrote:  Lastly, are you able to visit https://yomou.syosetu.com/ with default settings? From https://local.ptron/.pinfo/ssl/ I can see no site certificate is created for yomou.syosetu.com.

Certificate generation bug, fixed in 4.7.0.1. Thanks for reporting.

(Apr. 16, 2024 02:49 PM)whenever Wrote:  @amy, can you let new versions moving forward check for OpenSSL 3.x DLLs first and fall back to OpenSSL 1.x if OpenSSL 3.x DLLs are not present? This way I can put new and old proxo.exe, and new and old DLLs in the same directory without having to remove a specific version of DLLs to test another version of Proxo.exe.

Changed in 4.7.0.1. (I was renaming the 1.0.x DLLs to switch between them and 3.x, but your way works just as well, and it does seem to make more sense to load the latest OpenSSL version it can find.)

(Apr. 17, 2024 04:12 PM)Anno Domini Wrote:  Hi there, I can go to ebay.com without any issues, but I am unable to go to ebay.ca with the new Proxo 4.7.0.0. If I bypass Proxo it will go to ebay.ca, but with Proxo enabled it does not. Please see attached photo. I have the latest cacert.pem. Any thoughts ?

Certificate generation bug fixed in 4.7.0.1. The probability of getting a hostname that hit the bug was really low.