<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I am trying to configure an intercept proxy with peek/splice/terminate features in Squid 3.5.1 on CentOS 7 - 64 bit. I wanted to peak at steps 1 and step 2 and to decide on terminate on step 3 based on the SNI
and server certificate values. It is working only for <a href="https://www.google.com">
https://www.google.com</a>, but lot of other ssl sites (likes of <a href="https://www.yahoo.com">
https://www.yahoo.com</a> etc) are not getting loaded logging an “ <i>Error negotiating SSL on FD 36: error:140920E3:SSL routines:SSL3_GET_SERVER_HELLO:parse tlsext </i>“
<i> </i>in the cache.log (trying the same sites using openssl s_client command works). I was wondering if it has to do anything with my config or open ssl (version 1.0.1e) or anything else. The web sites are being accessed from a windows 7 workstation with
IE 8 and Firefox 35.0.1 . Below is the squid.config section for peek and splice I am using.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><i><span style="color:#1F497D">acl step1 at_step SslBump1<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D">acl step2 at_step SslBump2<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D">acl step3 at_step SslBump3<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D"><o:p> </o:p></span></i></p>
<p style="margin:0in;margin-bottom:.0001pt"><i><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">external_acl_type SSL_URL_Filter %SRC %ssl::>sni %ssl::<cert_subject </path/to/urlfilterscript><o:p></o:p></span></i></p>
<p style="margin:0in;margin-bottom:.0001pt"><i><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">acl URL_Allowed external SSL_URL_Filter<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D"><o:p> </o:p></span></i></p>
<p style="margin:0in;margin-bottom:.0001pt"><i><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ssl_bump peek step1 all<o:p></o:p></span></i></p>
<p style="margin:0in;margin-bottom:.0001pt"><i><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ssl_bump peek step2 all <o:p></o:p></span></i></p>
<p style="margin:0in;margin-bottom:.0001pt"><i><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ssl_bump terminate step3 !URL_Allowed<o:p></o:p></span></i></p>
<p style="margin:0in;margin-bottom:.0001pt"><i><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ssl_bump splice step3 all<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D"># Squid normally listens to port 3128<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D">http_port 3128<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D">http_port 3129 intercept<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#1F497D">https_port 3130 intercept ssl-bump cert=/tmp/sslcertificates/server.cert.pem key=/tmp/sslcertificates/server.key.pem<o:p></o:p></span></i></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks in Advance,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">John<o:p></o:p></span></p>
</div>
<div>
<p><font face="Verdana" size="2" color="#999999">Visit our Website at <a href="http://www.rmesi.co.in">
www.rmesi.co.in</a> <br>
<br>
This message is confidential and should not be copied or disclosed to anyone. If this email has come to you in error, please delete it, along with any attachments. Any views or opinions presented are only those of the author and not those of RMESI. RMESI accepts
no liability for any loss or damage which may be caused by software viruses and it is your responsibility to ensure that this email and any attachments are free of viruses when you receive it. You may use and apply this email and the information contained
in it for the intended purpose only and RMESI shall not be liable in any way in respect of use for any other purpose. In respect of all other matters, to the fullest extent permitted by applicable law, RMESI disclaims all responsibility and liability for the
contents of this email (including any attachments). Please note that RMESI may intercept incoming and outgoing email communications.
<br>
<br>
RM Education Solutions India Pvt Ltd (CIN: U72200KL2003PTC015931) is a company registered in India with its registered office at B-5 Gayatri Building, Technopark Campus, Trivandrum, Kerala, 695 581.
</p>
</div>
</font>
</body>
</html>