curl CONNECT method without path (destination hostname and port instead)

Question

I want to test proxy server. In order to make https request, browser sends CONNECT method beforehand (e.g. like Firefox does, when proxy is specified). I can not achieve/send the same result in curl:

Following has root slash /www.example.com:443:

curl -X CONNECT http://proxy_host:proxy_port/www.example.com:443

Following will not work (without slash):

curl -X CONNECT http://proxy_host:proxy_portwww.example.com:443

Following is not what I want:

curl -X CONNECT http://proxy_host:proxy_port/some_path

So the first line of HTTP data should be CONNECT www.example.com:443 HTTP/1.1 but not CONNECT /www.example.com:443 HTTP/1.1 like curl sends in this case.

Maybe this question also related some-how, if I would know how to not send path.

NOTE! I do not want to use curl -x http://proxy_host:proxy_port https://www.example.com, because this option/flag -x does not work with custom SSL certificates --cacert ... --key ... --cert ....

Any ideas how to send plain header data or not specify path, or specify host and port as a path?

Answer 1

(-X simply replaces the string in the request so of course setting it to CONNECT will not issue a proper CONNECT request and will certainly not make curl handle it correctly.)

curl will do a CONNECT by itself when connecting to a TLS server through a HTTP proxy, and even though you claim -x breaks the certificate options that is an incorrect statement. The --cacert and other options work the same even when the connection is done through a HTTP proxy.

You can also make curl do a CONNECT trough a HTTP(S) proxy for other protocols by using -p, --proxytunnel - also in combination with -x.

Answer 2

Maybe it's a bit late, but anyway, I'm posting it just in case anyone face the same problem.

You can change the target of the request manually with --request-target, see manpage. So the correct command should be:

curl -X CONNECT http://proxy_host:proxy_port --request-target www.example.com:443 -H 'Host: www.example.com:443'

Tested on Debian:

$ curl -v -X CONNECT http://172.17.80.1:7890 --request-target www.google.com:443 -H 'Host: www.google.com:443'
*   Trying 172.17.80.1:7890...
* Connected to 172.17.80.1 (172.17.80.1) port 7890 (#0)
> CONNECT www.google.com:443 HTTP/1.1
> Host: www.google.com:443
> User-Agent: curl/7.74.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 Connection established
* no chunk, no close, no size. Assume close to signal end
<
* Closing connection 0