Certificate rejected when using proxy - ssl

Question

I have to connect to a REST webservice, and use a certificate to authenticate myself.
Everything works perfectly when I connect from OUTSIDE our corporate network and DONT use a proxy server.
The problem is that i have to consume the service from WITHIN our network, where i HAVE to use the proxy server.
When i try from within the network i just get a "401 - Unauthorized"
private static void RestWithCert(string certificatePath,string baseUrl,string method)
{
HttpClientHandler handler = new HttpClientHandler();
//when trying the code OUTside our company network I remove the proxy below
handler.Proxy = new WebProxy("http://proxy.company.dk");
handler.ClientCertificates.Add(new X509Certificate2(certificatePath, "password"));
HttpClient client = new HttpClient(handler);
client.BaseAddress = new Uri(baseUrl);
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
HttpResponseMessage response = client.GetAsync(method).Result;
var status = response.StatusCode;
}
Outside the network, without proxy: Status = OK
Inside the network, with proxy: Status = Unauthorized
Inside the network, without proxy: Connection timed out
I have NO control over either Proxy or the webservice i am trying to access
What is happening? Is the proxy intercepting the certificate, and replacing it?

Answer 1

A proxy can capture SSL traffic and connect to the target server by acting as a ManInTheMiddle or allow the SSL connection to be made directly to the target server.
When client certificates are required, the proxy must allow the direct connection, because the proxy can not present a valid certificate when it is needed by target server. During SSL handshake some interchanged data is signed with the private key of the client certificate to authenticate the message and the proxy does not have that private ke
Probably your proxy is capturing the traffic. I suggest checking this. You can verify if the certificate received during SSL connection corresponds to the target server or proxy