Proxy authentication with s_client

Question

_{Note: this is not a duplicate of openssl s_client using a proxy, as I am specifically interested in proxy authentication, not the ability to use proxy.}

I'm using openssl s_client to inspect certificates of the target server to understand how/where the connection works or not. As I'm behind a corporate proxy, I can specify the proxy server with -proxy flag, however I need to pass authentication details (username/password) to this proxy - and I haven't figured out how to do that.

openssl s_client -proxy my.proxy.server:8080 -connect my.target.host

successfully connect to the proxy server, however, understandably, results in error s_client: HTTP CONNECT failed: 407 Unauthorized.

Passing proxy server in the form of user:[email protected] or http://user:[email protected] both result in error s_client: -proxy argument malformed or ambiguous.

How can I pass proxy authentication to s_client? I would find it hard to believe that it supports proxy but not authenticated proxy.

I'm using openssl version 1.1.1a.

Answer 1

Just to follow up on @Arnaud Grandville's answer: OpenSSL v3 beta 1 has now been released, and it includes proxy authentication options. You have to compile it yourself, however.

Unfortunately in v3 beta 1 the HTTP code had some issues so you can't use the code from their website as-is. Anyone looking to compile from source can use the commands below to get an OpenSSL installation with working proxy authentication:

git clone --branch openssl-3.0.0-beta1 https://github.com/openssl/openssl.git
cd openssl
git fetch
git checkout 6a1f9cd -- crypto/http/http_client.c
./Configure
make
make install

Edit: For later versions this is no longer necessary as the bug was fixed. For example for version 3.0.5 you can simply run:

git clone --branch openssl-3.0.5 https://github.com/openssl/openssl.git
cd openssl
./Configure
make
make install