Your App Works Everywhere Except the Corporate Network
You ship something. It works on your machine, in CI, in staging, and for every user who tries it. Then one customer opens a ticket: it doesn't work for them. Same version, same config, same everything. It just hangs, or throws a certificate error, or fails in some way your error handling never anticipated. They're on a corporate network. Somewhere between their machine and your server, a device…
When an application works flawlessly on a developer's machine and in testing environments, but encounters problems when deployed in a corporate network, the issue often lies in the inspection proxy used by large organizations to monitor traffic leaving their network. These proxies break the normal TLS connection between the client and server into two separate connections, allowing them to read and modify the data.
The main issues arise when the application uses a different trust store than the one used by the proxy. This can lead to five different failure modes:
1. The application's trust store doesn't use the system trust store by default. This is the most common issue and can be solved by pointing the application to the correct root CA certificates.
2. Certificate pinning is used, where the application explicitly requires a specific certificate or public key. The proxy can't fulfill this requirement and the connection fails.
3. Mutual TLS is used, where the server requires the client to present a certificate. The proxy can't provide the client's private key and the handshake fails.
4. Protocol upgrades and long-lived connections, like WebSockets or gRPC streams, can be disrupted by the proxy if it doesn't handle these correctly. This can lead to intermittent connection failures.
5. Browser compatibility issues. Some browsers, like Firefox, maintain their own trust store, which can lead to different behavior compared to other browsers like Chrome.
To troubleshoot these issues, it's important to understand which trust store the application is using and ensure it matches the one used by the proxy. For certificate pinning, administrators should be informed about the need to allow-list the domain from inspection. For mutual TLS, the server should specify the correct handshake process.
For protocol upgrades, the proxy should handle these correctly to prevent connection disruptions. By addressing these points, the issues with the application in corporate networks can be resolved.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
