TLS Pool could add HTTPS to Privoxy

Hello,

On your TODO list I noticed item #16 on support of HTTPS.  May I propose
99% of the solution?

I'm working on a TLS Pool daemon, which concentrates all the sensitive
handling of credentials in a process separate from the application
logic.  This process is initiated by passing sockets over a
POSIX-standard mechanism to the daemon, and have the daemon handle
handshaking, encryption and decryption.

Privoxy could be a plaintext filter in between an upstream and
downstream HTTPS connection.  Downstream (to the client/browser) there
is a need to add a certificate on-the-fly, signed under a root cert that
the client would need to accept.  This on-the-fly certification has been
specified for the TLS Pool and will be implemented soon.

Would this be a good solution for Privoxy?  One counter-argument could
be that an extra software component is required; that component however,
is of general use and has been designed with callback APIs that provide
a lot of control over the TLS connection to the users.  That includes
authentication through X.509, PGP, SRP and Kerberos, all with
credentials protected by a PKCS #11 API.  There is even a framework
coming up for centralised configuration of TLS policies.  Probably a bit
more than you would probably put in if you added TLS only for proxying :)

So I wonder, is this direction of interest to Privoxy?

https://github.com/arpa2/tlspool
https://tlspool.arpa2.net


Best wishes,

Rick van Rein
ARPA2.net

------------------------------------------------------------------------------