snoyberg/http-client — pull request #62 by himura (2014-07-09 14:12:10+00:00)
Title: SSL certificate rejected trying to access via proxy

When connecting to an HTTPS server via a proxy, the server's certificate is rejected unexpectedly with the NameMismatch exception.

Code:
~~~~ {.haskell}
req <- parseUrl "https://secure.example.com"
let req' = req { proxy = Just $ Proxy "proxy.example.com" 8080 }
withManager $ httpLbs req'
~~~~

and got:
~~~~
*** Exception: TlsException (HandshakeFailed (Error_Protocol ("certificate rejected: [NameMismatch \"proxy.example.com\"]",True,CertificateUnknown)))
~~~~

It seems that the http-client-tls package uses the proxy hostname as the SSL ServerName in the verification process of the SSL certificate.

This PR fixes this problem, and I've tested this code with squid-2.7.STABLE9-4.1+b1 (debian wheezy).