title: What does the proxy server do when proxying a https request
body: <p>I build a forward proxy server with apache using follow settings:</p>
  
  <pre><code>&lt;VirtualHost *:8088&gt;
      ServerAdmin test@gmail.com
      DocumentRoot "E:/test"
      ServerName www.test.com
      ServerAlias test.com
      ErrorLog "logs/test.com-error.log"
      CustomLog "logs/test.com-access.log" common
      &lt;Directory "E:/test"&gt;
          Options FollowSymLinks
          AllowOverride All
          Order allow,deny
          Allow from all
      &lt;/Directory&gt;
  
      ProxyRequests On
      ProxyVia Off
      ProxyTimeout 10
  
      &lt;Proxy *&gt;
          Order deny,allow
          Deny from all
          Allow from 127.0.0.1
      &lt;/Proxy&gt;
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>hosts file </p>
  
  <pre><code>127.0.0.1 localhost
  </code></pre>
  
  <p>Then I use curl to test the proxy server</p>
  
  <pre><code>curl.exe -v https://www.google.com.hk -x localhost:8088
  </code></pre>
  
  <p>The output</p>
  
  <pre><code>* About to connect() to proxy localhost port 8088 (#0)
  *   Trying 127.0.0.1... connected
  * Connected to localhost (127.0.0.1) port 8088 (#0)
  * Establish HTTP proxy tunnel to www.google.com.hk:443
  &gt; CONNECT www.google.com.hk:443 HTTP/1.1
  &gt; Host: www.google.com.hk:443
  &gt; User-Agent: curl/7.21.7 (amd64-pc-win32) libcurl/7.21.7 OpenSSL/0.9.8r zlib/1.
  2.5
  &gt; Proxy-Connection: Keep-Alive
  &gt;
  &lt; HTTP/1.0 200 Connection Established
  &lt; Proxy-agent: Apache/2.2.25 (Win32) PHP/5.4.21
  &lt;
  * Proxy replied OK to CONNECT request
  * successfully set certificate verify locations:
  *   CAfile: D:\curl-ssl\curl-ca-bundle.crt
    CApath: none
  * SSLv3, TLS handshake, Client hello (1):
  * SSLv3, TLS handshake, Server hello (2):
  * SSLv3, TLS handshake, CERT (11):
  * SSLv3, TLS handshake, Server finished (14):
  * SSLv3, TLS handshake, Client key exchange (16):
  * SSLv3, TLS change cipher, Client hello (1):
  * SSLv3, TLS handshake, Finished (20):
  * SSLv3, TLS change cipher, Client hello (1):
  * SSLv3, TLS handshake, Finished (20):
  * SSL connection using RC4-SHA
  * Server certificate:
  *        subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=*.googl
  e.com.hk
  *        start date: 2013-11-20 14:47:22 GMT
  *        expire date: 2014-03-20 00:00:00 GMT
  *        subjectAltName: www.google.com.hk matched
  *        issuer: C=US; O=Google Inc; CN=Google Internet Authority G2
  *        SSL certificate verify ok.
  &gt; GET / HTTP/1.1
  &gt; User-Agent: curl/7.21.7 (amd64-pc-win32) libcurl/7.21.7 OpenSSL/0.9.8r zlib/1.
  2.5
  &gt; Host: www.google.com.hk
  &gt; Accept: */*
  &gt;
  &lt; HTTP/1.1 200 OK
  &lt; Date: Thu, 05 Dec 2013 02:21:27 GMT
  &lt; Expires: -1
  &lt; Cache-Control: private, max-age=0
  &lt; Content-Type: text/html; charset=Big5
  &lt; Set-Cookie: PREF=ID=12cdbbbf43c234b5:FF=0:NW=1:TM=1386210087:LM=1386210087:S=B
  HZ4WAj3fqZicDa_; expires=Sat, 05-Dec-2015 02:21:27 GMT; path=/; domain=.google.c
  om.hk
  &lt; Set-Cookie: NID=67=EvwPZiG49GZO1AMLw7cTY1Azrqzb77uTpCUv9rOECEJh4PRB523yMIJm8L5
  OxxWBeq44qM-Dn8xYUijDmBrvXfL504U4_FSunEfG5UUIDveWbHG2BirORx5Jqk9MVFkd; expires=F
  ri, 06-Jun-2014 02:21:27 GMT; path=/; domain=.google.com.hk; HttpOnly
  &lt; P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/
  bin/answer.py?hl=en&amp;answer=151657 for more info."
  &lt; Server: gws
  &lt; X-XSS-Protection: 1; mode=block
  &lt; X-Frame-Options: SAMEORIGIN
  &lt; Alternate-Protocol: 443:quic
  &lt; Transfer-Encoding: chunked
  &lt;
  ...  The google home page HTML ...
  </code></pre>
  
  <p>I think the https proxying flow is:</p>
  
  <ol>
  <li><p>send a CONNECT http request to the proxy server</p></li>
  <li><p>the proxy server forward this CONNECT request to www.google.com.hk:443</p></li>
  <li><p>www.google.com.hk:443 return a response of 200 Connection Establish to the proxy server</p></li>
  <li><p>proxy server forward the response to curl</p></li>
  <li><p>curl begin to send tls handshake datagram (Maybe is encrypted?) to the proxy server</p></li>
  <li><p>proxy server doesn't know anything about the datagram since the datagram is encrypted, the proxy server just forward this datagram to www.google.com.hk:443 using the socket which it sent the CONNECT request before.</p></li>
  <li><p>www.google.com.hk:443 send tls handshake datagram encrypted to the proxy server</p></li>
  <li><p>proxy server forward the encrypted data to curl without decrypting</p></li>
  <li><p>... after several times handshakes, the handshakes finished and start to send a GET request</p></li>
  <li><p>curl send a GET request to proxy server , this request datagram is encrypted</p></li>
  <li><p>proxy server forward the encryted datagram to www.google.com.hk:443 using the socket mentioned above</p></li>
  <li><p>www.google.com.hk:443 return a encrypted response</p></li>
  <li><p>proxy server forward the response to curl</p></li>
  <li><p>curl decrypts the response and show the html</p></li>
  </ol>
  
  <p>I don't know whether my understanding is right, especially after STEP 3, curl received the 200 CONNECTION ESTABLISHED response.</p>
  
  <p>What I want to know is that what does the proxy server do after receiving the 200 CONNECTION ESTABLISHED response, does the proxy decypts the request datagram? </p>