<div dir="ltr">See below. Nothing else too interesting. Those four lines were the key.<br><br>http_port 3128<br>http_port 3180 intercept<br>https_port 3443 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB cert=/usr/local/squid/ssl_cert/myCA.pem<br>sslcrtd_program /usr/lib64/squid/ssl_crtd -s /usr/local/squid/var/lib/ssl_db -M 16MB<br>sslcrtd_children 10<br>logformat dig %{%Y-%m-%d %H:%M:%S}tl %6tr %>a %Ss/%03>Hs %<st %rm %ru %un %Sh/%<A "%{User-Agent}>h"<br>logfile_rotate 10<br>access_log /var/log/squid/access.log dig<br>pinger_enable off<br><br>acl step1 at_step SslBump1<br>acl step2 at_step SslBump2<br>ssl_bump peek step1 all<br>ssl_bump server-first step2 all<br><br>acl SSL_ports port 443<br>acl Safe_ports port 80 443 <br>acl CONNECT method CONNECT<br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br><br>http_access allow localhost manager<br>http_access deny manager<br>http_access deny to_localhost<br><br>http_access allow all<br>http_access deny all<br><br># Uncomment and adjust the following to add a disk cache directory.<br>#cache_dir ufs /var/spool/squid 100 16 256<br><br># Leave coredumps in the first cache dir<br>coredump_dir /var/spool/squid<br><br>#<br># Add any of your own refresh_pattern entries above these.<br>#<br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br><br><br><br><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature">-----------<br>Daniel I Greenwald<br><br><br></div></div>
<br><div class="gmail_quote">On Mon, Jan 26, 2015 at 3:28 AM, Rafael Akchurin <span dir="ltr"><<a href="mailto:rafael.akchurin@diladele.com" target="_blank">rafael.akchurin@diladele.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div style="font-size:12pt;color:#000000;background-color:#ffffff;font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Hello Daniel, Yuri<br>
</p>
<p><br>
</p>
<p>May be you could dump your whole squid.conf here (please remove any sensitive details).<br>
</p>
<p>I still cannot understand once Squid has the target server hostname from SNI - where is the acl/rule in squid.conf that can be used with this info present?<br>
</p>
<p><br>
</p>
<p>Best regards,<br>
</p>
<p>Rafael<br>
</p>
<p><br>
</p>
<div style="color:rgb(33,33,33)">
<hr style="display:inline-block;width:98%">
<div dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> squid-users <<a href="mailto:squid-users-bounces@lists.squid-cache.org" target="_blank">squid-users-bounces@lists.squid-cache.org</a>> on behalf of Daniel Greenwald <<a href="mailto:dig@digcorp.net" target="_blank">dig@digcorp.net</a>><br>
<b>Sent:</b> Monday, January 26, 2015 5:39 AM<br>
<b>To:</b> Yuri Voinov<br>
<b>Cc:</b> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<b>Subject:</b> Re: [squid-users] Why 3.5.0.4 generates mimicked certs with server IP only when bumping?</font>
<div> </div>
</div><div><div class="h5">
<div>
<div dir="ltr">
<div>
<div>Thank you Amos,<br>
</div>
Based on your explanation I was able to make bumping work for transparent with no browser errors in 3.5.1 by using the following. If I understand correctly, this is actually whats required to mimic the behavior of pre 3.5 (sslbump server-first all) :<br>
<br>
acl step1 at_step SslBump1<br>
acl step2 at_step SslBump2<br>
ssl_bump peek step1 all<br>
ssl_bump server-first step2 all<br>
<br>
</div>
Hope that helps Yuri or any one else with this issue. <br>
<br>
PS So far this is working great for eg <a href="http://gmail.com" target="_blank">gmail.com</a> which in previous version would throw browser errors!<br>
</div>
<br clear="all">
<div>
<div>-----------<br>
Daniel I Greenwald<br>
<br>
<br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Jan 9, 2015 at 2:51 PM, Yuri Voinov <span dir="ltr">
<<a href="mailto:yvoinov@gmail.com" target="_blank">yvoinov@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span><br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
</span>How can that be?<br>
<br>
All HSTS sites cry with 3.5 bump option - they don't like host IP as CN,<br>
other sites behaviour depending they (and browsers) settings.<br>
<br>
Is it possible to keep server-first behaviour in 3.5.x ?<br>
<span><br>
WBR, Yuri<br>
<br>
09.01.2015 16:57, Amos Jeffries пишет:<br>
</span><span>> On 9/01/2015 11:45 p.m., Yuri Voinov wrote:<br>
><br>
> > I have working production 3.4.10 with working ssl bumping.<br>
><br>
> > Config was the same as working 3.4.10. I've just want to take a<br>
> > look on new release.<br>
><br>
> > in squid.documented said, than backward compatibility server-first<br>
> > and none options for ssl_bump are kept.<br>
><br>
> > But:<br>
><br>
> > Neither works with old syntax, nor new.<br>
><br>
> > Looks like target https hosts not resolved and bump got only IP.<br>
><br>
> The config values are still accepted, but there is an extra bumping<br>
> stage now before the SNI is available.<br>
><br>
> You are wanting to peek at stage 1 (to get the client SNI details) and<br>
> server-first/splice at stage 2 (using the domain). Otherwise All Squid<br>
> works with when intercepting are the TCP IPs.<br>
><br>
> Amos<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
</span>iQEcBAEBAgAGBQJUsDE9AAoJENNXIZxhPexGl+MH/2wEV5rEDSb6eQ5KRbHI8ZJ4<br>
WV0fdTg7yFR+bfWCUYzjVovQhrx0gaIFLNWvuwDbc62zJJnvADQuAzu7chouafkP<br>
wpGuBjjp3jYZWa1TlZN4XoDeK2THswXau/5kY9P7IKKAJu9VjhjII803ywn5C8DW<br>
48NQWU0Uhs86Tr6XAuaRzUYZK6lht0VcJFKiftmKmOE7Rl7+Yy/Kak1zXxLh8mzX<br>
a8N0DSsSlBqIm7s8yngwWQuf8rQ0tlwrKWNSpCL3xD6Wk0MFwhRqe6Vbncj4sbff<br>
p0OifMf0YD5sbytsUq4OO5HOdO7WPu+foB2AMKSiou5cDMqz5Vcnw0mD35t25Fg=<br>
=OEZu<br>
<div>
<div>-----END PGP SIGNATURE-----<br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div></div></div>
</div>
</div>
</blockquote></div><br></div>