@@ -24,44 +24,40 @@ graph TD
2424```
2525### TLS Communication Flow
2626
27- ``` mermaid
28- info
29- ```
30-
3127``` mermaid
3228sequenceDiagram
3329 participant Client
34- participant ForwardProxy as Forward Proxy <br/>Port: 6443 r/ (TLS Server)
35- participant ReverseProxy as Reverse Proxy\nPort : 7443\n (TLS Server)
36- participant HTTPServer as HTTP Server\nPort : 8443\n (mTLS Server)
30+ participant ForwardProxy as Forward Proxy <br/>Port: 6443 <br/> (TLS Server)
31+ participant ReverseProxy as Reverse Proxy<br/>Port : 7443<br/> (TLS Server)
32+ participant HTTPServer as HTTP Server<br/>Port : 8443<br/> (mTLS Server)
3733
3834 Note over Client,HTTPServer: Phase 1: Client → Forward Proxy TLS
3935
4036 Client->>ForwardProxy: TLS Client Hello (TLSv1.3) with CA Certificate
4137 ForwardProxy->>Client: Server Hello + Certificate Chain
42- Note right of ForwardProxy: CN=server\nIssuer : forward-proxy Root CA\nSAN : 127.0.0.1
38+ Note right of ForwardProxy: CN=server<br/>Issuer : forward-proxy Root CA<br/>SAN : 127.0.0.1
4339 ForwardProxy->>Client: Certificate Verify + Finished
4440 Client->>ForwardProxy: Finished
4541 Note over Client,ForwardProxy: TLS Connection Established
4642
4743 Note over Client,HTTPServer: Phase 2: HTTP CONNECT Tunnel
4844
49- Client->>ForwardProxy: CONNECT reverse-proxy-server:7443 HTTP/1.1\nHost : reverse-proxy-server:7443\nProxy -Connection: Keep-Alive
45+ Client->>ForwardProxy: CONNECT reverse-proxy-server:7443 HTTP/1.1<br/>Host : reverse-proxy-server:7443<br/>Proxy -Connection: Keep-Alive
5046 ForwardProxy->>Client: HTTP/1.1 200 Connection Established
5147 Note over Client,ForwardProxy: CONNECT Tunnel Established
5248
5349 Note over Client,HTTPServer: Phase 3: Client → Reverse Proxy TLS (through tunnel)
5450
55- Client->>ReverseProxy: TLS Client Hello (TLSv1.3)\nvia Forward Proxy tunnel
56- ReverseProxy->>Client: Server Hello + Certificate Chain\nvia Forward Proxy tunnel
57- Note right of ReverseProxy: CN=server\nIssuer : reverse-proxy Root CA\nSAN : reverse-proxy-server
58- ReverseProxy->>Client: Certificate Verify + Finished\nvia Forward Proxy tunnel
59- Client->>ReverseProxy: Finished\nvia Forward Proxy tunnel
51+ Client->>ReverseProxy: TLS Client Hello (TLSv1.3)<br/>via Forward Proxy tunnel
52+ ReverseProxy->>Client: Server Hello + Certificate Chain<br/>via Forward Proxy tunnel
53+ Note right of ReverseProxy: CN=server<br/>Issuer : reverse-proxy Root CA<br/>SAN : reverse-proxy-server
54+ ReverseProxy->>Client: Certificate Verify + Finished<br/>via Forward Proxy tunnel
55+ Client->>ReverseProxy: Finished<br/>via Forward Proxy tunnel
6056 Note over Client,ReverseProxy: End-to-End TLS Established
6157
6258 Note over Client,HTTPServer: Phase 4: HTTP Request/Response
6359
64- Client->>ReverseProxy: GET /server1 HTTP/1.1\nHost : reverse-proxy-server:7443\nAccept : */*
60+ Client->>ReverseProxy: GET /server1 HTTP/1.1<br/>Host : reverse-proxy-server:7443<br/>Accept : */*
6561
6662 Note over ReverseProxy,HTTPServer: Phase 5: Reverse Proxy → HTTP Server mTLS
6763
@@ -72,22 +68,22 @@ sequenceDiagram
7268 Note over ReverseProxy,HTTPServer: mTLS Connection Established
7369
7470 ReverseProxy->>HTTPServer: GET /server1 HTTP/1.1 (over mTLS)
75- HTTPServer->>ReverseProxy: HTTP/1.1 200 OK\nContent -Type: text/html
71+ HTTPServer->>ReverseProxy: HTTP/1.1 200 OK<br/>Content -Type: text/html
7672
77- ReverseProxy->>Client: HTTP/1.1 200 OK\nContent -Type: text/html\nConnection : close\n\nHello from Server 1
73+ ReverseProxy->>Client: HTTP/1.1 200 OK<br/>Content -Type: text/html<br/>Connection : close<br/><br/>Hello from Server 1
7874
7975 Note over Client,HTTPServer: Certificate Chain Verification
8076
8177
82- Note over ForwardProxy: Server Cert: CN=server\nCA : forward-proxy Root CA\nValidates : --proxy-cacert ca.crt
78+ Note over ForwardProxy: Server Cert: CN=server<br/>CA : forward-proxy Root CA<br/>Validates : --proxy-cacert ca.crt
8379
8480
8581
86- Note over ReverseProxy: Server Cert: CN=server\nCA : reverse-proxy Root CA\nValidates : --cacert ca.crt
82+ Note over ReverseProxy: Server Cert: CN=server<br/>CA : reverse-proxy Root CA<br/>Validates : --cacert ca.crt
8783
8884
8985
90- Note over HTTPServer: mTLS Required\nClient + Server Certificates\nMutual Authentication
86+ Note over HTTPServer: mTLS Required<br/>Client + Server Certificates<br/>Mutual Authentication
9187```
9288
9389
0 commit comments