[squid-users] Squid not allowing HTTPS access

Nilesh Gavali nilesh.gavali at tcs.com
Tue Jun 14 17:36:46 UTC 2016

Hello Eliezer;

Many Thanks, It work for me on 3.1.10

Thanks & Regards
Nilesh Gavali

From:   Eliezer Croitoru <eliezer at ngtech.co.il>
To:     'Nilesh Gavali' <nilesh.gavali at tcs.com>, 
squid-users at lists.squid-cache.org, Antony.Stone at squid.open.source.it
Date:   14/06/2016 18:00
Subject:        RE: [squid-users] Squid not allowing HTTPS access

The issue is that CONNECT request can be passed only directly to the 
origin server on 3.1.
Try to add:
never_direct allow all
To your squid.conf and see if it works.
I do not remember if it works for all versions.
Eliezer Croitoru
Linux System Administrator
Mobile: +972-5-28704261
Email: eliezer at ngtech.co.il

From: squid-users [mailto:squid-users-bounces at lists.squid-cache.org] On 
Behalf Of Nilesh Gavali
Sent: Tuesday, June 14, 2016 4:43 PM
To: squid-users at lists.squid-cache.org; Antony.Stone at squid.open.source.it
Subject: [squid-users] Squid not allowing HTTPS access
Hello Antony; 
I have setup like below :- 

end user >> LinuxProxy(3.1.10) >> External Proxy(3.4)>> Internet 
when we configure external proxy ip in end user's IE, all HTTP & HTTPS 
site work properly. 
when we configure Linux proxy ip in end user's IE, HTTP works fine but 
none of the HTTPS site open. 
when we access https site from LinuxProxy, below logs are appearing in 
        TCP_DENIED/407 CONNECT sitename:443 -  NONE/ text/html 
        TCP_MISS/503 0 CONNECT sitename:443 username at MYDOMAIN.COM DIRECT / 
- - 
        TCP_MISS/200 23456 GET http://www.anysite.com 
username at MYDOMAIN.COM         DEFAULT_PARENT/10.10.x.x text/html 

what I making out from log is ( I might be wrong) - HTTPS request are 
going directly instead . 

attached is my Linux Proxy config- 

# Recommended minimum configuration: 

#auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -d -s 
auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -s 
HTTP/proxy02.abcd.com at ABCD.COM -d 
auth_param negotiate children 10 
auth_param negotiate keep_alive on 
auth_param basic credentialsttl 2 hours 
acl ad_auth proxy_auth REQUIRED 

acl manager proto cache_object 
acl localhost src ::1 
acl to_localhost dst ::1 

# Example rule allowing access from your local networks. 
# Adapt to list your (internal) IP networks from where browsing 
# should be allowed 
acl localnet src        # RFC1918 possible internal network 
acl localnet src        # RFC1918 possible internal network 
acl localnet src        # RFC1918 possible internal network 

acl localnet src fc00::/7       # RFC 4193 local private network range 
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) 

acl SSL_ports port 443 
acl Safe_ports port 80                # http 
acl Safe_ports port 21                # ftp 
acl Safe_ports port 443                # https 
acl Safe_ports port 70                # gopher 
acl Safe_ports port 210                # wais 
acl Safe_ports port 1025-65535        # unregistered ports 
acl Safe_ports port 280                # http-mgmt 
acl Safe_ports port 488                # gss-http 
acl Safe_ports port 591                # filemaker 
acl Safe_ports port 777                # multiling http 

# Recommended minimum Access Permission configuration: 
# Only allow cachemgr access from localhost 
http_access allow manager localhost 
http_access deny manager 

# Deny requests to certain unsafe ports 
http_access deny !Safe_ports 

# Deny CONNECT to other than secure SSL ports 
http_access deny CONNECT !SSL_ports 

# We strongly recommend the following be uncommented to protect innocent 
# web applications running on the proxy server who think the only 
# one who can access services on "localhost" is a local user 
#http_access deny to_localhost 

# Example rule allowing access from your local networks. 
# Adapt localnet in the ACL section to list your (internal) IP networks 
# from where browsing should be allowed 
#http_access allow localnet 
#http_access allow localhost 
http_access deny !ad_auth 
http_access allow ad_auth 

# And finally deny all other access to this proxy 
http_access deny all 

# Squid normally listens to port 3128 
http_port 8080 

cache_peer xx.xx.2.108 parent 8080 0 default 
#dns_nameservers ABCDNS.ABCD.COM 
dns_nameservers xx.xx.2.108 

# We recommend you to use at least the following line. 
#hierarchy_stoplist cgi-bin ? 

# Uncomment and adjust the following to add a disk cache directory. 
cache_dir ufs /var/spool/squid 2048 16 256 

# Leave coredumps in the first cache dir 
coredump_dir /var/spool/squid 
# Log forwarding to SysLog 
access_log syslog:local1.info 

# Add any of your own refresh_pattern entries above these. 
refresh_pattern ^ftp:                1440        20%        10080 
refresh_pattern ^gopher:        1440        0%        1440 
refresh_pattern -i (/cgi-bin/|\?) 0        0%        0 
refresh_pattern .                0        20%        4320 

Thanks & Regards
Nilesh Suresh Gavali
Tata Consultancy Services
3rd Floor, Tithebarn House
Tithebarn Street
Liverpool - L2 2NZ
United Kingdom
Mailto: nilesh.gavali at tcs.com
Website: http://www.tcs.com
Experience certainty.        IT Services
                       Business Solutions

Tata Consultancy Services Limited , incorporated  with limited liability 
and registered with Registrar of Companies, Mumbai, India - No: 11-84781
HQ : Nirmal Building , 9th Floor, Nariman Point, Mumbai - 400 021, India - 
 Registered  in UK : 18 Grosvenor Place, London SW1X 7HS - BR :007627

----- Forwarded by Nilesh Gavali/MUM/TCS on 14/06/2016 14:41 ----- 

From:        Nilesh Gavali/MUM/TCS 
To:        squid-users at lists.squid-cache.org 
Date:        13/06/2016 14:00 
Subject:        Squid not allowing HTTPS access 

Hello All; 
Facing issue while accessing HTTPS via squid, normal http traffic working 
fine. I have squid 3.1.10 on RHEL.6.0 

attached is my squid .conf for your reference,..help will be much 

Thanks & Regards
Nilesh Suresh Gavali
Notice: The information contained in this e-mail
message and/or attachments to it may contain 
confidential or privileged information. If you are 
not the intended recipient, any dissemination, use, 
review, distribution, printing or copying of the 
information contained in this e-mail message 
and/or attachments to it are strictly prohibited. If 
you have received this communication in error, 
please notify us by reply e-mail or telephone and 
immediately and permanently delete the message 
and any attachments. Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20160614/f175dc50/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 11307 bytes
Desc: not available
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20160614/f175dc50/attachment-0001.png>

More information about the squid-users mailing list