Thanks Ahmed, That worked, well sort of anyway.
Squid is now successfully transparently intercepting SSL but as stated on the wiki, certificate rewrite doesn't work. So I guess the only real solution is explicit proxy. I tried to play around with WPAD + PAC but that is only useful when PCs are on a corporate network with centrally managed DNS/DHCP. My clients are home users with their own broadband routers which manage their own DHCP. So any ideas what I can do if I want to set up a proxy service for SSL with minimum effort required from users and no control of DHCP? Thanks Daniel -----Original Message----- From: Ahmed Talha Khan [mailto:[email protected]] Sent: 17 April 2012 10:21 To: Daniel Niasoff Cc: [email protected] Subject: Re: [squid-users] squid 3.2.0.17 + transparent + sslbump > Hi > > I know this question has been asked before but I didn't quite comprehend the > answer. > > I have got squid working as an explicit SSL proxy using SSLbump with Dynamic > SSL certs. > > I have also managed to get it working as a transparent proxy. > > When I try the combination of the above 2 it doesn't seem to work. > > It seems to be rewriting my https requests to http. Also dynamic ssl certs > doesn't seem to be working. However squid definitely intercepts the request > so it seems like the NAT bit is fine. I am not sure about the code in 3.2 but i faced a similar issue in 3.1.19 and i think the problem is still lurking in 3.2 as well. You might want to look at http://bugs.squid-cache.org/show_bug.cgi?id=2976. There is a hard-coded value that causes all requests to be forcibly written to "http" even "https". You can reverse it via this patch http://bugs.squid-cache.org/attachment.cgi?id=2375 > > When I browse a website that's listening on 443 only I get "Zero Sized Reply" > and when I browse a website that's listening on both 80/443 it works > sometimes but the certificate is wrong. > > This person seems to have it working > > http://dvas0004.wordpress.com/2011/03/22/squid-transparent-ssl-interce > ption/ > > and I am pretty much copying his config. > > Here is my relevant config > > --------------------------------------------------------------- > http_port 3128 transparent > https_port 3129 transparent ssl-bump generate-host-certificates=on > dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl/proxy.pem > http_port 8080 ssl-bump generate-host-certificates=on > dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl/proxy.pem > > always_direct allow all > ssl_bump allow all > # the following two options are unsafe and not always necessary: > sslproxy_cert_error allow all > sslproxy_flags DONT_VERIFY_PEER > -------------------------------------------------------------- > > Thanks > > Daniel > > -- Regards, -Ahmed Talha Khan
