Using Faraday to connect to a server using SSL proxy

[ns89-web]

hello practicioners/ experts,

I am trying to implement the below curl command using Faraday; but I get a "end of file reached error":

curl request curl -v --proxy-cacert /path/to/proxy-cert.pem  https://target-site.com/ -x https://proxy.com 

Note: the proxy-cert.pem is a self-signed certificate
I am a newbie and would like to know how to achieve this using Faraday. I am unable to find an option equivalent to the --proxy-cacert in curl in most of Faraday's adapters.

The below code is something I tried using Net:HTTP and it does not work :

uri = URI.parse("https://target-site.com")
proxy_uri = URI.parse('https://proxy.com')

http = Net::HTTP.new(uri.host, uri.port, proxy_uri.host, proxy_uri.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER

http.ca_file = '<path to self signed certificate identifying the proxy>'

begin
	request = Net::HTTP::Get.new(uri.request_uri)
	res = http.request(request)

	# Finish HTTP connection.
	http.finish if http.started?
rescue => e  
	result = e
	puts ("Connection to destination #{uri.host} failed with error #{e}")

Error I get is as below :

Conn close because of connect error end of file reached
/usr/lib/ruby/2.5.0/net/protocol.rb:189:in `rbuf_fill'
/usr/lib/ruby/2.5.0/net/protocol.rb:157:in `readuntil'
/usr/lib/ruby/2.5.0/net/protocol.rb:167:in `readline'
/usr/lib/ruby/2.5.0/net/http/response.rb:40:in `read_status_line'
/usr/lib/ruby/2.5.0/net/http/response.rb:29:in `read_new'
/usr/lib/ruby/2.5.0/net/http.rb:958:in `connect'
/usr/lib/ruby/2.5.0/net/http.rb:920:in `do_start'
/usr/lib/ruby/2.5.0/net/http.rb:909:in `start'
/usr/lib/ruby/2.5.0/net/http.rb:1458:in `request'

Does any of Faraday's adapter's support this? Any pointers will be appreciated.

[iMacTia]

Hi @ns89-web, apologies for the late reply, I had to look into this as I didn't know the answer honestly!
I've never used that cURL option before, so I can't really say for sure, but I can potentially point you in the right direction.

In Faraday, you can both set a proxy and provide a certificate file with some simple options (the code below is for the net-http adapter):

options = {
  proxy: 'https://proxy.com',
  ssl: {
    ca_file: '/path/to/proxy-cert.pem'
  }
}

conn = Faraday.new('https://target-site.com/', **options)

You can see how the options above are used in configure_ssl and net_http_connection methods.

Now, as far as I know, this sets both the proxy and the certificate (*.pem) for the request. What I don't know though is if the certificate will be used only for the proxy or not! That might be the missing piece in case the above fails, but honestly I would need to have a working snippet using Net::HTTP to tell if the same is possible with Faraday.

One more thing to do would be to checkout patron and it's corresponding Faraday adapter. Patron is a Ruby wrapper around cURL, so it would make sense to provide the same functionality as --proxy-cacert somehow. If that's the case, then we can probably make it work with faraday-patron or add it in if necessary 😄.

Sorry if I couldn't provide a clear solution to your issue! I hope this helps at least.
Please keep us posted if you make any progress as it may benefit others in future ❤️