# Struggling with TLS
**URL:** https://discourse.mitmproxy.org/t/struggling-with-tls/961
**Category:** help
**Created:** [April 5, 2018, 8:13pm UTC](https://discourse.mitmproxy.org/t/struggling-with-tls/961 "2018-04-05T20:13:01Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@fazega](https://discourse.mitmproxy.org/u/fazega)
#### Post date: [April 5, 2018, 8:13pm UTC](https://discourse.mitmproxy.org/t/struggling-with-tls/961/1 "2018-04-05T20:13:01Z")
There are a lot of issues concerning TLS and handshakes failures, due to HSTS, PKP or Android’s policy concerning user certificate.
I was wondering if it’s possible to disable TLS handshake by the client, redirect him via a 302 to an http connection and handle the TLS handshake by the proxy with the destination server (so that the communication between the client and the proxy is http, the communication between the proxy and the server is httpS).
I’m struggling with mitmproxy to make that up, with a transparent proxy. The TLS handshake seems to happen even before the ‘request’ event is called, so I can’t make my 302 …
Thank you
---
### Author:  [@mhils](https://discourse.mitmproxy.org/u/mhils)
#### Post date: [April 7, 2018, 5:24pm UTC](https://discourse.mitmproxy.org/t/struggling-with-tls/961/2 "2018-04-07T17:24:12Z")
> I’m struggling with mitmproxy to make that up, with a transparent proxy. The TLS handshake seems to happen even before the ‘request’ event is called, so I can’t make my 302 …
Yes - this is precisely how TLS works. If the clients wants to connect using TLS, we can’t perform a downgrade attack on the client. If we try to intercept and that fails, the browser will (rightfully) always serve a security warning.
---
### Author:  [@fazega](https://discourse.mitmproxy.org/u/fazega)
#### Post date: [April 7, 2018, 7:20pm UTC](https://discourse.mitmproxy.org/t/struggling-with-tls/961/3 "2018-04-07T19:20:19Z")
Yes I just understood that TLS happens on the session layer … Do you know if I can still tell the client not to use the mitmproxy certificate if there is a handshake failure (so that I can still use my Android apps for instance, even without seeing the secured traffic) ?
Thank you for your always gentle answers 😉
---
### Author:  [@mhils](https://discourse.mitmproxy.org/u/mhils)
#### Post date: [April 9, 2018, 2:17am UTC](https://discourse.mitmproxy.org/t/struggling-with-tls/961/4 "2018-04-09T02:17:55Z")
Hi,
In the simplest case, you can just use mitmproxy’s ignore feature: [https://docs.mitmproxy.org/stable/howto-ignoredomains/](https://docs.mitmproxy.org/stable/howto-ignoredomains/)
If you need something more automated, take a look at [https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/tls\_passthrough.py](https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/tls_passthrough.py). 🙂