我正在通过企业Squid代理发送HTTPS请求，代理使用NTLM认证和SSL Bump，客户端为Chilkat HTTP v11.4.0 (.NET)。

NTLM认证成功（200 Connection established），但TLS握手始终失败：

NTLM proxy connect success
convertToTls:
  sendClientHello - OK
  readHandshakeMessages:
    v84.84, ct=72, sz=20527
    Connection closed by peer.
    Failed to read TLS record (2)

我尝试过：

• SslProtocol = "TLS 1.2"，"TLS 1.3 or higher"
• SslAllowedCiphers = "best-practices"
• TrustedRoots.Activate()，带Squid CA证书
• RequireSslCertVerify = true/false
• glob.DefaultNtlmVersion = 1

可行之处： 通过同一代理的HttpClient（Windows SChannel）工作正常。

Wireshark的发现： 在 200 Connection established 之后，Squid对 Chilkat的 ClientHello返回 HTTP/1.1 400 Bad Request（Cloudflare）。HttpClient的 ClientHello能通过。我们注意到的差异是：HttpClient发送 key_share 与 x25519, secp256r1, secp384r1，而Chilkat只发送 secp256r1。

有没有办法配置Chilkat，使其在通过SSL Bump代理时的TLS行为与HttpClient相匹配？

ChilkatLog:
  QuickGetObj(563ms):
    DllDate: Mar 29 2026
    ChilkatVersion: 11.4.0
    UnlockStatusMsg: Unlocked for 30-day trial
    UnlockStatus: 1
    Architecture: Little Endian; 64-bit
    Language: Visual C++ 2022 / x64
    VerboseLogging: 1
    quickRequestObj(563ms):
      url: https://httpbin.org/get
      verb: GET
      quickRequestDb(563ms):
        url: https://httpbin.org/get
        getHttpConnectionByUrl:
          findAddHttpConn:
            sbHostname0: httpbin.org
            port: 443
            bTls: True
            bForceNewConnection: False
            sbProxyDomain: [PROXY_HOST]
            proxyPort: [PROXY_PORT]
            numExistingConnections: 0
            lookingForHost: [httpbin.org]
            lookingForPort: 443
            lookingForProxy: [[PROXY_HOST]]
            Will need to open a new connection.
          --findAddHttpConn
        --getHttpConnectionByUrl
        a_quickReq(547ms):
          quickHttpRequest(547ms):
            httpVerb: GET
            url: https://httpbin.org/get
            openHttpConnection(547ms):
              Opening connection through an HTTP proxy.
              proxyDomain: [PROXY_HOST]
              proxyPort: [PROXY_PORT]
              httpHostname: httpbin.org
              httpPort: 443
              tls: True
              bUsingHttpProxy: True
              httpProxyAuthMethod:
              m_httpProxyTls: False
              Using a CONNECT tunnel...
              socket2Connect(547ms):
                Using HTTP proxy CONNECT...
                httpProxyConnect(344ms):
                  proxyAuthMethod:
                  proxyHostname: [PROXY_HOST]
                  proxyPort: [PROXY_PORT]
                  No proxy authentication method specified.
                  proxyUsername is empty
                  proxyPassword is empty
                  connectSocket_v2(31ms):
                    domainOrIpAddress: [PROXY_HOST]
                    port: [PROXY_PORT]
                    connectTimeoutMs: 30000
                    This is an IPV4 numeric address.
                    createSocket_ipv4:
                      Setting SO_SNDBUF size
                      sendBufSize: 262144
                      Setting SO_RCVBUF size
                      recvBufSize: 4194304
                    --createSocket_ipv4
                    connect(31ms):
                      Waiting for the connect to complete...
                      connectTimeoutMs: 30000
                      myIP: [CLIENT_IP]
                      myPort: 56403
                      socket connect successful.
                    --connect
                  --connectSocket_v2
                  connectRequest: CONNECT httpbin.org:443 HTTP/1.1
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Host: httpbin.org:443
                  connectResponseHeader: HTTP/1.1 407 Proxy Authentication Required
Server: squid/5.7
...
                  The server supports the NTLM proxy authentication method.
                  Re-trying with NTLM proxy authentication...
                  proxyConnectNtlm(313ms):
                    login:
                    domain:
                    proxyAuthMethod:
                    password is empty
                    Will use MS SSPI...
                    connectSocket_v2(16ms):
                      domainOrIpAddress: [PROXY_HOST]
                      port: [PROXY_PORT]
                      connectTimeoutMs: 30000
                      This is an IPV4 numeric address.
                      createSocket_ipv4:
                        Setting SO_SNDBUF size
                        sendBufSize: 262144
                        Setting SO_RCVBUF size
                        recvBufSize: 4194304
                      --createSocket_ipv4
                      connect(16ms):
                        Waiting for the connect to complete...
                        connectTimeoutMs: 30000
                        myIP: [CLIENT_IP]
                        myPort: 56404
                        socket connect successful.
                      --connect
                    --connectSocket_v2
                    Using NTLM as the default SSPI package name...
                    sspiBegin:
                      acquireSspiCredentials:
                        sspi_username:
                        sspi_domain:
                        password is empty
                        Using default NTLM credentials.
                      --acquireSspiCredentials
                      prepareOutboundPackage:
                        SSPI will continue...
                      --prepareOutboundPackage
                    --sspiBegin
                    ConnectRequest: CONNECT httpbin.org:443 HTTP/1.1
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Host: httpbin.org
Proxy-Authorization: NTLM [NTLM_TOKEN_1]
                    Sending CONNECT with NTLM Type1 message to proxy...
                    Receiving NTLM TYPE2 message from proxy...
                    type1ResponseHeader: HTTP/1.1 407 Proxy Authentication Required
Server: squid/5.7
...
Proxy-Authenticate: NTLM [NTLM_CHALLENGE]
...
                    NtlmChallenge: [NTLM_CHALLENGE]
                    sspiNext:
                      prepareOutboundPackage:
                        SSPI finished.
                      --prepareOutboundPackage
                    --sspiNext
                    Sending CONNECT with NTLM Type3 message to proxy...
                    type3ResponseHeader: HTTP/1.1 200 Connection established

                    contentLength: 0
                  --proxyConnectNtlm
                  HTTP proxy connect success
                --httpProxyConnect
                convertToTls(203ms):
                  Clearing TLS client certificates.
                  clientHandshake(203ms):
                    The client cert chain is NULL.
                    cacheClientCerts:
                      Cached TLS client certificates.
                      Client cert chain is NULL.
                    --cacheClientCerts
                    clientHandshake2(203ms):
                      sendClientHello(15ms):
                        clientHello_buildMessage(15ms):
                          gen_key_shares(15ms):
                            generateNewKey_ecc(15ms):
                              loadCurveByName:
                                name: secp256r1
                              --loadCurveByName
                            --generateNewKey_ecc
                          --gen_key_shares
                        --clientHello_buildMessage
                      --sendClientHello
                      readHandshakeMessages(188ms):
                        maxToReceive: 20260
                        Connection closed by peer.
                        passiveClose(16ms):
                          Passive socket closing complete.
                        --passiveClose
                        Failed to read TLS record (2)
                        tlsRec_msg: 0
                        msgLen: 20527
                        nReadNBytes: 0
                        status: 0
                      --readHandshakeMessages
                    --clientHandshake2
                  --clientHandshake
                  Client handshake failed. (1)
                  connectionClosed: 1
                --convertToTls
                Failed to establish SSL/TLS channel after HTTP proxy connection.
              --socket2Connect
              connect: Socket connection closed.
            --openHttpConnection
          --quickHttpRequest
        --a_quickReq
      --quickRequestDb
      Failed.
    --quickRequestObj
  --QuickGetObj
--ChilkatLog

解决方案

不能，而且答案其实就在你眼前。你无法手动修改Chilkat的 TLS栈参数；相反，你可以考虑如下做法：

1. 为你的客户端禁用SSL Bump
2. 使用SChannel代替Chilkat。

从Wireshark的描述来看，这似乎是Chilkat的一个限制。Cloudflare期望某种密钥交换类型，而Chilkat无法发送，正如它所支持的组所示。