I have a Wiremock proxy deployed on my kubernetes cluster along with my client application. The Wiremock proxy is used to act as froward proxy for

<http://graph.microsoft.com|graph.microsoft.com>

endpoint which is outside my network

Setup is similar to this

Now I want the traffic between client and WM to be on HTTPS, therefore I have deployed WM with appropriate certificate which is trusted by the client application using the

--https-keystore

option. I don't want to proxy over HTTP because then I will need to disable cert verification in my client app.

Connection between WM and

<http://graph.microsoft.com|graph.microsoft.com>

will necessarily need to be on HTTPS because HTTP is not supported. Anyways this part of the communication is not my major concern because my usecase is that I want WM to act as a mock server for

<http://graph.microsoft.com|graph.microsoft.com>

so the the API requests to microsoft needs to be intercepted by WM and return mock response.

Now the issue is that when I try to proxy over HTTPS client fails with below error

requests.exceptions.SSLError: HTTPSConnectionPool(host='<http://graph.microsoft.com|graph.microsoft.com>', port=443): Max retries exceeded with url: /v1.0/organization?$top=999 (Caused by SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for '<http://graph.microsoft.com|graph.microsoft.com>'. (_ssl.c:1000)")))

Now if you look closely it seems that

requests

lib in python is trying to establish a TLS connection with

<http://graph.microsoft.com|graph.microsoft.com>

which is failing since WM is not running with the cert of

<http://graph.microsoft.com|graph.microsoft.com>

.

When I performed the same with curl I noticed that there are two TLS handshake happening 1. Between client and WM 2. Between client and

<http://graph.microsoft.com|graph.microsoft.com>

using WM cert (this is obviously failing)

I am not able to understand why the second TLS handshake is happening? Isn't WM was supposed to perform the TLS handshake with

<http://graph.microsoft.com|graph.microsoft.com>

.

Any help here will be much appreciated.

From curl logs I can see

CONNECT

being used

* CONNECT tunnel: HTTP/1.1 negotiated
* allocate connect buffer
* Establish HTTP proxy tunnel to <http://graph.microsoft.com:443|graph.microsoft.com:443>
> CONNECT <http://graph.microsoft.com:443|graph.microsoft.com:443> HTTP/1.1
> Host: <http://graph.microsoft.com:443|graph.microsoft.com:443>
> User-Agent: curl/8.5.0
> Proxy-Connection: Keep-Alive

Which is again something I did not expect. Isn't WM was suppoed to terminate the TLS from Client and start a new TLS session with the Target ?

@Tom any thoughts here?