title: openssl s_client TLS connection through proxy with clientAuth
body: <p>I'd like to use <code>openssl s_client</code> to open a TLS connection through a proxy (Squid) to an origin server using the CONNECT request method. I am using a client certificate to connect to the proxy server as shown:</p>
  
  <blockquote>
    <p><code>openssl s_client -connect my_proxy:4443 -CAfile /etc/ssl/ca/ca.crt -cert /etc/ssl/cert/client.crt -key /etc/ssl/key/client_key.pem</code></p>
  </blockquote>
  
  <p>After running the above, connection information prints out fine and then I enter the CONNECT and GET methods, and this works fine:</p>
  
  <blockquote>
    <p><code>CONNECT www.google.com:80 HTTP/1.1
    Host: www.google.com</code></p>
    
    <p>HTTP/1.1 200 Connection established</p>
    
    <p><code>GET /search?q=ip+address HTTP/1.1
    Host: www.google.com</code></p>
    
    <p>HTTP/1.1 200 OK</p>
  </blockquote>
  
  <p>However, I would really like to be able to establish a TLS (https) connection but I haven't been able to get it to work:</p>
  
  <blockquote>
    <p><code>CONNECT www.google.com:443 HTTP/1.1
    Host: www.google.com</code></p>
    
    <p>HTTP/1.1 200 Connection established</p>
    
    <p><code>GET /search?q=ip+address HTTP/1.1</code></p>
    
    <p>closed</p>
  </blockquote>
  
  <p>What am I doing wrong here? Before you say to try OpenSSL 1.1.x which has the -proxy parameter, I've already tried that. Note that the CA cert, client cert and client key on the above command are for the connection to my proxy server, not for the target server (google.com), as shown below with OpenSSL 1.1.0-pre3 (same output if I try to connect to google:443).</p>
  
  <blockquote>
    <p><code>openssl s_client -connect google.com:80 -proxy my_proxy:4443 -CAfile /etc/ssl/ca/ca.crt -cert /etc/ssl/cert/client.crt -key /etc/ssl/key/client_key.pem</code></p>
    
    <p>CONNECTED(00000003)</p>
    
    <p>s_client: HTTP CONNECT failed</p>
    
    <p>no peer certificate available</p>
    
    <p>No client certificate CA names sent
    SSL handshake has read 0 bytes and written 25 bytes
    Verification: OK</p>
    
    <p>New, (NONE), Cipher is (NONE)
    Secure Renegotiation IS NOT supported
    Compression: NONE
    Expansion: NONE
    No ALPN negotiated</p>
  </blockquote>
  
  <p>I was able to load my client cert, client key, and CA cert into Firefox (all bundled in a pkcs12 file) and am able to connect to various websites through TLS. This should be possible on the command line. </p>