Proxy tunneling failed: ForbiddenUnable to establish SSL connection.

Linux and Unix-Like Red Hat
1

Tryied both ways

curl

and

wget

wget --no-check-certificate  https://mysitet.it:61617
--2017-05-05 17:29:02--  https://mysitet.it:61617/
Connecting to myproxy:8080... connected.
Proxy tunneling failed: ForbiddenUnable to establish SSL connection.

curl  https://mysite.it:61617
curl: (56) Received HTTP code 403 from proxy after CONNECT

My Exports are the following,

export http_proxy=http://myproxy:8080/
export https_proxy=https://myproxy:443/
export https_proxy=http://myproxy:8080/

All the sites that have the ports 80, 8080 and 443 are working just fine,
and also doing the test directly on myproxy the uper tests work just fine,

[root@myproxy ~]# curl --insecure  https://mysite.it:61617
?ActiveMQ
         w
          TcpNoDelayEnabledSizePrefixDisabled	CacheSize
                                                         ProviderName  ActiveMQStackTraceEnabledPlatformDetails	RJVM: 1.8.0_121, 25.121-b13, Oracle Corporation, OS: Linux, 4.4.0-47-generic, amd64
                                                                                                                                                                                                   CacheEnabledTightEncodingEnabled
                                                                                                                                                                                                                                   MaxFrameSize???????MaxInactivityDurationu0 MaxInactivityDurationInitalDelay'ProviderVersion	5.14.3

and also the

wget

[root@myproxy ~]# wget --no-check-certificate mysitet.it:61617
--2017-05-05 19:40:07--  https://mysite.it:61617/
Resolving mysite.it (mysite.it)... 88.88.255.255
Connecting to mysitet.it (mysitet.it)|88.88.255.255|:61617... connected.
WARNING: cannot verify mysite.it's certificate, issued by �/C=IT/ST=Location/L=Location/O=MySite/OU=Technology/CN=My Name':
  Self-signed certificate encountered.
    WARNING: certificate common name �My Name' doesn't match requested host name �mysitet.it'.
HTTP request sent, awaiting response... 200 No headers, assuming HTTP/0.9
Length: unspecified
Saving to: �index.html.2'

    [ <=>                                                                                                                                                                                            ] 397         --.-K/s   in 0s      

2017-05-05 19:40:07 (70.2 MB/s) - �index.html.2' saved [397]

Do you see if i'm doing something wrong?
releases
GNU Wget 1.14 built on linux-gnu.

curl 7.29.0

(x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.15.4 zlib/1.2.7 libidn/1.28 libssh2/1.4.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp 
Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz 

NAME="Red Hat Enterprise Linux Server"
VERSION="7.1 (Maipo)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="7.1"
PRETTY_NAME="Red Hat Enterprise Linux Server 7.1 (Maipo)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:7.1:GA:server"
HOME_URL="https://www.redhat.com/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 7"
REDHAT_BUGZILLA_PRODUCT_VERSION=7.1
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="7.1"

Could you guys have a look?
Thank in advanced for any sugestions.

2

That forbidden, I think, is coming from the proxy itself - not wget.

Try adding --server-response to see if that will tell you more about why.

3

Hi Corona,
it doesn't print nothing new,

wget --server-response --no-check-certificate  https://mysite.it:61617
--2017-05-05 20:12:06--  https://mysite.it:61617/
Connecting to myproxy:8080... connected.
Proxy tunneling failed: ForbiddenUnable to establish SSL connection.

Oh by the way

squid

is also disabled

systemctl status squid
squid.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)
4

SOLVED,
if anyone need this specific, i added on myproxy on the

/etc/squid/squid.conf

the port

acl SSL_ports port 61617

Regards

1 Like