<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EstiloCorreo17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ES" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="CA">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">We are using a 3.4.8 squid Proxy in intercept mode via wccp.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">Squid intercepts HTTP and HTTPS via ssl_bump.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">All is working fine except that Windows Machines can’t do a Windows Update.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">It is not working at all giving an error 80072F8F<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">with HTTPS redirection disabled all work fine.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">Someone knows how to maintain the SSL interception with a functional Windows Update ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">Josep<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">Squid.conf:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA"># Disable Cache for defined domains<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">acl disable-dom-cache dstdomain -i "/etc/squid3/no-cache.acl"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">cache deny disable-dom-cache<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">cache allow all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">#HTTPS (SSL) trafic interception options<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">sslcrtd_program /usr/lib/squid3/ssl_crtd -s /var/spool/squid3_ssldb -M 4MB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">sslcrtd_children 8 startup=1 idle=1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"># Disable ssl_bump for defined domains (using rDNS not always work !!)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">acl disable-ssl-bump dstdomain -i "/etc/squid3/no-ssl-bump.acl"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">ssl_bump none disable-ssl-bump<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">ssl_bump server-first all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA"># Videos/Musics/Images/Libraries Accelerator<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">store_id_program /etc/squid3/ut-storeid.php<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">store_id_children 25 startup=10 idle=5 concurrency=0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">acl storeiddoms dstdomain -i '/etc/squid3/api-storeid-trial.txt'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">store_id_access allow storeiddoms<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">store_id_access deny all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">client_dst_passthru off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">http_access allow all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">http_port 3128<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">http_port 8080 intercept<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">https_port 8081 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid3/ssl_cert/squidcert.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">forward_max_tries 25<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">cache_mem 2 GB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">maximum_object_size_in_memory 25 MB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">maximum_object_size 1 GB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">visible_hostname squid-v2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">coredump_dir /var/spool/squid3<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">cache_replacement_policy heap LFUDA<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">cache_dir aufs /var/spool/squid3 45000 16 256<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">refresh_pattern ^http:\/\/.*\.unveiltech\.internal.* 10080 80% 79900 override-expire override-lastmod refresh-ims reload-into-ims ignore-reload ignore-no-store ignore-private ignore-auth ignore-must-revalidate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">refresh_pattern ^ftp: 1440 20% 10080<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">refresh_pattern ^gopher: 1440 0% 10080<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">refresh_pattern . 0 80% 10080<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA"># FortiGate interface of wccp<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">wccp2_router 192.168.111.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"># wccp version 2 configuration<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">wccp2_service standard 90<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"># tunneling method GRE for forward traffic<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">wccp2_forwarding_method gre<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"># tunneling method GRE for return traffic<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">wccp2_return_method gre<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"># which interface to use for WCCP (0.0.0.0 determines the interface from routing)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">wccp2_address 0.0.0.0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="CA">snmp_port 3401<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA">snmp_access allow all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="CA"><o:p> </o:p></span></p>
</div>
</body>
</html>