[squid-users] Squid 3.4.8 Reverse with multiple SSL Sites and multiple Certs/Domains

Maik Linnemann maik.linnemann at modelco.de
Tue Apr 11 10:44:55 UTC 2017



Dear List, 

i use squid3 as reverse Proxy since a while for multiple sites, hosted on different targets. All those sites work with SSL they use a wildcard cert. It works well so far. Now i need to host another site, with a different domain and another ssl certificate. Can i configure squid to use cert by the requested url likewise? i just tried to copy my existing stuff and edit it to another cert, but this doesnt take me far as squid always takes the main cert file. my config is like:

<FROM HERE I AM GOOD>

https_port <IP>:443 accel vhost defaultsite=webmail.somedomain.info cert=/etc/squid3/certs/wildcard/wirldcard.crt key=/etc/squid3/certs/wildcard/wildcard.key
cache_peer 192.168.111.20 parent 443 0 proxy-only no-query no-digest login=PASS connection-auth=off ssl sslflags=DONT_VERIFY_PEER,DONT_VERIFY_DOMAIN originserver name=webmail
cache_peer_domain webmail ssl webmail.somedomain.info
acl url_allow url_regex -i ^https://webmail.somedomain.info/owa.*$
acl url_allow url_regex -i ^https://webmail.somedomain.info/ecp.*$

cache_peer 192.168.111.51 parent 443 0 proxy-only no-query no-digest login=PASS connection-auth=off ssl sslflags=DONT_VERIFY_PEER,DONT_VERIFY_DOMAIN originserver name=git
cache_peer_domain git ssl git.somedomain.info
acl url_allow url_regex -i ^https://git.somedomain.info/.*$

<UNTIL HERE I AM GOOD>

<THIS IS NOT REALLY WORKING>

https_port www.anotherdomain.de:443 accel vhost defaultsite=anotherdomain.de cert=/etc/ssl/certs-anotherdomain.de/anotherdomain.de.pem key=/etc/ssl/private-anotherdomain.de/anotherdomain.de.key
cache_peer 192.168.1.1 parent 443 0 proxy-only no-query no-digest login=PASS connection-auth=off ssl sslflags=DONT_VERIFY_PEER,DONT_VERIFY_DOMAIN originserver name=anotherdomain

<THIS IS NOT REALLY WORKING>

How can i host multiple Sites and tell squid to use the cert i attach to each site or domain?

thanks in advance, 

with regards,


More information about the squid-users mailing list