<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<span style="white-space: pre;"> </span><br>
Well the documentation says<br>
<br>
# SslBump1: After getting TCP-level and HTTP CONNECT info.<br>
# SslBump2: After getting SSL Client Hello info.<br>
# SslBump3: After getting SSL Server Hello info.<br>
<br>
<br>
So that means SslBump1 only works for direct proxy (ie CONNECT)
sessions, it's SslBump2 that peeks into the traffic to discover the
client SNI hostname. So I think you actually need (I'll use more
descriptive acl names and comment out those that I think don't add
any value)<br>
<br>
acl domains_nobump dstdomain "/etc/squid/domains_nobump.acl"<br>
#no added value: acl DiscoverCONNECTHost at_step SslBump1<br>
acl DiscoverSNIHost at_step SslBump2<br>
#don't use - breaks bump: acl DiscoverServerHost at_step SslBump3<br>
#no added value - in fact forces peek for some reason: ssl_bump peek
DiscoverCONNECTHost all<br>
ssl_bump peek DiscoverSNIHost all<br>
<br>
ssl_bump splice domains_nobump<br>
#DiscoverSNIHost should now mean Squid knows about all the SNI
details<br>
ssl_bump bump all<br>
<br>
Sadly, this doesn't work for me *in transparent mode*. Works fine
when using squid as a formal proxy, but when used via https_port
intercept, we end up with IP address certs instead of SNI certs.<br>
<br>
We really need someone who knows more to tell us how to make this
work :-(<br>
<br>
<br>
-- <br>
Cheers<br>
<br>
Jason Haar<br>
Corporate Information Security Manager, Trimble Navigation Ltd.<br>
Phone: +1 408 481 8171<br>
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1<br>
<br>
</body>
</html>