Forward HTTPS requests to a web server without the need for an HTTP CONNECT message

An explicit web proxy can forward HTTPS requests to a web server without the need for an HTTP CONNECT message. The FortiGate explicit web proxy can be configured to detect the HTTPS scheme in the request line of a plain text HTTP request and forward it as an HTTPS request to the web server. This allows applications that cannot use the CONNECT message for sending an HTTPS request to communicate with the web server through an explicit web proxy.

config firewall proxy-policy
    edit <id>
        set detect-https-in-http-request {enable | disable}
    next
end

Example

Based on the following topology, an HTTPS request is sent to a web server through an explicit web proxy.

To enable detection of HTTPS in an HTTP request:

1. Configure the explicit web proxy:

   config web-proxy explicit
       set status enable
       set ftp-over-http enable
       set socks enable
       set http-incoming-port 8080
       set ipv6-status enable
       set unknown-http-version best-effort
   end

2. Enable the explicit web proxy on port1:

   config system interface  
       edit "port1"
           set ip 10.1.100.2 255.255.255.0
           set explicit-web-proxy enable
       next
   end

3. Configure the proxy policy:

   config firewall proxy-policy
       edit 1
           set proxy explicit-web
           set dstintf "port3"
           set srcaddr "all"
           set dstaddr "all"
           set service "webproxy"
           set action accept
           set schedule "always"
           set logtraffic all
           set utm-status enable
           set ssl-ssh-profile "deep-inspection"
           set av-profile "av"
           set detect-https-in-http-request enable
       next
   end

   An SSL-SSH profile with deep inspection must be applied in order to decrypt the server response in HTTPS and forward the response to the client by HTTP.

4. Using Telnet, send an HTTP request with an HTTPS scheme as follows:

   telnet 10.1.100.2 8080
   Trying 10.1.100.2...
   Connected to 10.1.100.2.
   Escape character is '^]'.
   POST https://172.16.200.33/ HTTP/1.1
   Host: 172.16.200.33
   User-Agent: curl/7.68.0
   Accept: */*
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 0
   
   HTTP/1.1 200 OK

5. Verify the traffic log. The HTTP request is forwarded to the server successfully by HTTPS:

   # execute log filter category 3
   ...
   2: date=2023-07-31 time=16:02:22 eventtime=1690844541296891542 tz="-0700" logid="0000000010" type="traffic" subtype="forward" level="notice" vd="vdom1" srcip=10.1.100.11 srcport=46074 srcintf="port1" srcintfrole="undefined" dstcountry="Reserved" srccountry="Reserved" dstip=172.16.200.33 dstport=443 dstintf="port3" dstintfrole="undefined" sessionid=1799884153 service="HTTPS" proxyapptype="web-proxy" proto=6 action="accept" policyid=1 policytype="proxy-policy" poluuid="73379360-2d21-51ee-77d8-154efc517a6a" trandisp="snat" transip=172.16.200.2 transport=2713 duration=4 wanin=3053 rcvdbyte=3053 wanout=757 lanin=169 sentbyte=169 lanout=279 appcat="unscanned"