Mitmproxy Client TLS Handshake Failed: Understanding Custom Certificates and Cipher Suites

When connecting to an upstream server using mitmproxy, a TLS handshake failure can occur due to various reasons. One common cause is the use of custom client certificates. In this article, we will explore the importance of custom certificates in mitmproxy clients and how they can be used to resolve TLS handshake failures.

Using Custom Certificates

Mitmproxy, when acting as a client connecting to an upstream server, provides a certificate to the upstream server. However, this is not the only reason a handshake may fail. A directory variant allows certs to be selected based on hostname, while using a filename allows a single specific certificate to be used for all TLS connections.

A use case for using custom certificates arises when different servers require different certificates from their clients. In such scenarios, the directory variant can be used to store the required certificate based on the hostname. This approach enables mitmproxy to provide the correct certificate to each upstream server, ensuring a successful TLS handshake.

Forcing Server to Accept Lower Versions

Another common issue that can cause a TLS handshake failure is the difference in supported versions of the protocol between the client and server. If the client only supports older versions and none of the newer versions advertised by the server, the connection fails. This can be solved by forcing the server to accept lower versions as well, which in mitmproxy can be achieved using a command line option.

TLS 1.3: A New Era

The latest version of the TLS protocol, TLS 1.3, has introduced significant changes to the way encryption and hashing work. One major difference is the list of ciphers that can or cannot be used to encrypt data or hash certificates. TLS 1.0 and SSL are actually quite subtle when it comes to understanding the differences between them.

For those who may not be familiar with the basics of TLS, here's a brief explanation: TLS (Transport Layer Security) is a protocol that enables encrypted communication between two parties. It was previously known as SSL (Secure Sockets Layer), but the term SSL has largely been phased out in favor of TLS.

In summary, custom certificates can play a crucial role in resolving TLS handshake failures when connecting to an upstream server using mitmproxy. By using directory variants and storing required certificates based on hostname, mitmproxy can provide the correct certificate to each upstream server, ensuring a successful TLS handshake. Additionally, forcing servers to accept lower versions of the protocol can also help resolve issues related to version incompatibility.

Mitmproxy client tls handshake failed