Among various internet access methods, the HTTPS proxy is arguably the simplest, most convenient, and fastest. It eliminates the hassle of VPN dial-up connections and the need to install various client applications. Moreover, the software used for setup has a long history and is highly stable.
Note: If you wonder why such a great method isn’t widely adopted, the answer might be that it requires some money ($), specifically a dual-currency or multi-currency credit card to purchase necessary components: a Virtual Private Server (VPS), a domain name, and an SSL certificate. I recommend Linode for VPS services, not because I get a referral commission if you use my link, but because Linode is very generous; they automatically upgrade your CPU, memory, disk space, and bandwidth for free as technology advances. For domain names and SSL certificates, please refer to my previous article, “How to Purchase Cheap SSL Certificates.” The total cost for all these items in a shopping cart is approximately $150 or more per year. If you are on a tight budget, consider sharing the purchase with others.
Returning to the main topic, there are many server-side software options for implementing an HTTPS proxy. You can use the classic yet stable Squid, pair a lightweight HTTP proxy program with the venerable Stunnel, or try the newer Node-spdyproxy.
Below is an introduction to a relatively simple solution: combining the lightweight HTTP proxy Tinyproxy with Stunnel.
1. Install Tinyproxy and Stunnel
First, use the package manager of your Linux distribution to install Tinyproxy and Stunnel. For example:
$ sudo yum install tinyproxy stunnel // For CentOS Linux
$ sudo pacman -S tinyproxy stunnel // For Arch Linux
After installation, you may optionally configure them to start automatically at boot.
2. Configure Stunnel
Place your private key and purchased certificate files into /etc/stunnel/, then edit the file stunnel.conf. First, specify the filenames for the private key and certificate:
cert = /etc/stunnel/mycert.pem key = /etc/stunnel/mykey.pem
Note that certificates purchased from providers usually come as several small files, typically including: your domain certificate, a certificate chain certificate, and a root certificate. Open them with a text editor and copy-paste them in the order mentioned above into a single file. This combined file is what is required for the “cert=” line above.
Next, specify port redirection. For instance, bind and redirect port 443 (the default HTTPS port) to Tinyproxy’s default port 8888:
[https] accept = 443 connect = 127.0.0.1:8888
Here, “[https]” is just a label for this binding section and can be named arbitrarily. “accept” indicates the port listened to on the local machine, while “connect” specifies where the traffic should be forwarded. In essence, this adds an SSL encryption layer to 127.0.0.1:8888 and serves it externally via port 443.
3. Client Configuration
Currently, only Google Chrome natively supports HTTPS/SPDY proxies (other browsers require running Stunnel locally on the client to translate HTTPS to HTTP). Interestingly, Chrome does not have its own independent proxy settings page. Using the system-wide HTTPS proxy setting will not work (because the system’s HTTPS proxy refers to the HTTP proxy channel used when accessing HTTPS websites, which is different from the HTTPS proxy discussed here). Therefore, you need to install the extension TunnelSwitch in Chrome and set the HTTPS proxy address to “your-domain-name:443” within the plugin. Once done, you can browse the internet directly.
4. A Cost-Saving Solution for Tinkerers
If you wish to save on SSL certificate costs, you can generate a “self-signed” certificate yourself. However, if you plan to share this proxy with others, consider this approach carefully, as self-signed certificates can be cumbersome for non-technical users.
You can generate a self-signed certificate using the following commands:
openssl genrsa -out key.pem 1024
openssl req -new -key key.pem -subj "/CN=localhost" -out req.pem
openssl x509 -req -days 365 -in req.pem -signkey key.pem -out cert.pem
Remember to replace “localhost” with your actual domain name. The useful files are the private key file key.pem and the certificate file cert.pem. Replace the corresponding files mentioned in Step 2 with these two.
Then, clients must import this cert.pem file to successfully use your HTTPS proxy service. The method for importing certificates varies across operating systems:
- In Linux, it is somewhat complicated and requires the libnss3 tool certutil. Use the following command:
$ certutil -d "sql:$HOME/.pki/nssdb" -A -n dummy -i cert.pem -t C
- In macOS, use the Keychain Access tool and drag the certificate into the “Certificates” category.
- In Windows, double-click the certificate file and select “Trusted Root Certification Authorities” when prompted for the import location.
Finally, restart your Chrome browser.