[squid-users] Squid not allowing HTTPS access

Nilesh Gavali nilesh.gavali at tcs.com
Tue Jun 14 13:43:16 UTC 2016

Hello Antony;
I have setup like below :-

end user >> LinuxProxy(3.1.10) >> External Proxy(3.4)>> Internet

when we configure external proxy ip in end user's IE, all HTTP & HTTPS 
site work properly.
when we configure Linux proxy ip in end user's IE, HTTP works fine but 
none of the HTTPS site open.
when we access https site from LinuxProxy, below logs are appearing in 
        TCP_DENIED/407 CONNECT sitename:443 -  NONE/ text/html 
        TCP_MISS/503 0 CONNECT sitename:443 username at MYDOMAIN.COM DIRECT / 
- -
        TCP_MISS/200 23456 GET http://www.anysite.com 
username at MYDOMAIN.COM   DEFAULT_PARENT/10.10.x.x text/html

what I making out from log is ( I might be wrong) - HTTPS request are 
going directly instead .

attached is my Linux Proxy config-

# Recommended minimum configuration:

#auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -d -s 
auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -s 
HTTP/proxy02.abcd.com at ABCD.COM -d
auth_param negotiate children 10
auth_param negotiate keep_alive on
auth_param basic credentialsttl 2 hours
acl ad_auth proxy_auth REQUIRED

acl manager proto cache_object
acl localhost src ::1
acl to_localhost dst ::1

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src     # RFC1918 possible internal network
acl localnet src  # RFC1918 possible internal network
acl localnet src # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) 

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http

# Recommended minimum Access Permission configuration:
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
#http_access allow localhost
http_access deny !ad_auth
http_access allow ad_auth

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 8080

cache_peer xx.xx.2.108 parent 8080 0 default
#dns_nameservers ABCDNS.ABCD.COM
dns_nameservers xx.xx.2.108

# We recommend you to use at least the following line.
#hierarchy_stoplist cgi-bin ?

# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /var/spool/squid 2048 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
# Log forwarding to SysLog
access_log syslog:local1.info

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

Thanks & Regards
Nilesh Suresh Gavali
Tata Consultancy Services
3rd Floor, Tithebarn House
Tithebarn Street
Liverpool - L2 2NZ
United Kingdom
Mailto: nilesh.gavali at tcs.com
Website: http://www.tcs.com
Experience certainty.   IT Services
                        Business Solutions

Tata Consultancy Services Limited , incorporated  with limited liability 
and registered with Registrar of Companies, Mumbai, India - No: 11-84781
HQ : Nirmal Building , 9th Floor, Nariman Point, Mumbai - 400 021, India - 
 Registered  in UK : 18 Grosvenor Place, London SW1X 7HS - BR :007627

----- Forwarded by Nilesh Gavali/MUM/TCS on 14/06/2016 14:41 -----

From:   Nilesh Gavali/MUM/TCS
To:     squid-users at lists.squid-cache.org
Date:   13/06/2016 14:00
Subject:        Squid not allowing HTTPS access

Hello All;
Facing issue while accessing HTTPS via squid, normal http traffic working 
fine. I have squid 3.1.10 on RHEL.6.0

attached is my squid .conf for your reference,..help will be much 

Thanks & Regards
Nilesh Suresh Gavali
Notice: The information contained in this e-mail
message and/or attachments to it may contain 
confidential or privileged information. If you are 
not the intended recipient, any dissemination, use, 
review, distribution, printing or copying of the 
information contained in this e-mail message 
and/or attachments to it are strictly prohibited. If 
you have received this communication in error, 
please notify us by reply e-mail or telephone and 
immediately and permanently delete the message 
and any attachments. Thank you

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20160614/f0633222/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: squid.conf
Type: application/octet-stream
Size: 3149 bytes
Desc: not available
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20160614/f0633222/attachment.obj>

More information about the squid-users mailing list