<html><body>
<p><font size="2" face="sans-serif">That's good to know.</font><br>
<br>
<font size="2" face="sans-serif">With a transparent interception SSL-bump enabled Squid, I suppose I do not have to explicitly</font><br>
<font size="2" face="sans-serif">configure anything in my https client, and that Squid must listen on the port my client is trying to</font><br>
<font size="2" face="sans-serif">connect to (443) and that my squid.conf file must look something like this:</font><br>
<br>
<tt><font size="3">http_port 443 ssl-bump cert=/usr/local/squid3/etc/site_priv+pub.pem</font></tt><font size="2" face="sans-serif"><br>
</font><br>
<font size="2" face="sans-serif">where cert points to the location of a certificate designed to look like the certificate of the actual destination server (my reverse proxy).</font><br>
<br>
<font size="2" face="sans-serif">In this case there is no http and no HTTP CONNECT required?</font><br>
<br>
<br>
<img width="16" height="16" src="cid:1__=08BBF768DFF169CE8f9e8a93df938@us.ibm.com" border="0" alt="Inactive hide details for Yuri Voinov ---03/01/2015 12:52:26 PM--------BEGIN PGP SIGNED MESSAGE----- Hash: SHA1"><font size="2" color="#424282" face="sans-serif">Yuri Voinov ---03/01/2015 12:52:26 PM--------BEGIN PGP SIGNED MESSAGE----- Hash: SHA1</font><br>
<br>
<font size="1" color="#5F5F5F" face="sans-serif">From: </font><font size="1" face="sans-serif">Yuri Voinov <yvoinov@gmail.com></font><br>
<font size="1" color="#5F5F5F" face="sans-serif">To: </font><font size="1" face="sans-serif">Julianne Bielski/Raleigh/IBM@IBMUS</font><br>
<font size="1" color="#5F5F5F" face="sans-serif">Cc: </font><font size="1" face="sans-serif">squid-users@lists.squid-cache.org, squid-users <squid-users-bounces@lists.squid-cache.org></font><br>
<font size="1" color="#5F5F5F" face="sans-serif">Date: </font><font size="1" face="sans-serif">03/01/2015 12:52 PM</font><br>
<font size="1" color="#5F5F5F" face="sans-serif">Subject: </font><font size="1" face="sans-serif">Re: [squid-users] question about encrypted connection between https client and Squid</font><br>
<hr width="100%" size="2" align="left" noshade style="color:#8091A5; "><br>
<br>
<br>
<tt><font size="2">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
<br>
<br>
01.03.15 23:45, Julianne Bielski пишет:<br>
> Normally my infrastructure looks like:<br>
> <br>
> <br>
> client -- HTTP CONNECT (not encrypted) ---> proxy client ------<br>
> TCP tunnel ---> proxy --- TCP tunnel ---> reverse proxy client ---<br>
> HTTPS application payload ---------------> reverse proxy<br>
> <br>
> Now I need it to look like:<br>
> <br>
> client -------- HTTPS application payload ----> proxy ---- HTTPS <br>
> application payload ----> reverse proxy<br>
<br>
No problem. This will work - and with only one encryption on every<br>
stage. Proxy can pass both - CONNECT with tunneling to reverse proxy,<br>
or bumped HTTPS connection.<br>
<br>
In my installation this scheme is works with most Web-sites uses<br>
reverse proxies. I use transparent interception SSL-bump enabled Squid.<br>
<br>
<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> From: Yuri Voinov <yvoinov@gmail.com> To:<br>
> squid-users@lists.squid-cache.org Date: 03/01/2015 12:26 PM <br>
> Subject: Re: [squid-users] question about encrypted connection<br>
> between https client and Squid Sent by: "squid-users"<br>
> <squid-users-bounces@lists.squid-cache.org><br>
> <br>
> <br>
> <br>
> <br>
> 01.03.15 23:18, Julianne Bielski пишет:<br>
> <br>
>> I have an https client (not a browser) that normally connects to<br>
>> a reverse proxy. When it needs to go through a forward proxy, it <br>
>> requests a CONNECT tunnel. I now have a requirement to also be<br>
>> able to encrypt the connection between my client and the forward<br>
>> proxy, and I think this is possible using Squid and the<br>
>> https_port directive (??)<br>
> Yep.<br>
> <br>
>> My question is, will my https client now have to decrypt twice? <br>
>> Once for the connection with the forward proxy and once for the <br>
>> connection with the reverse proxy?<br>
> <br>
> Re-encryption will performs only in case SSL-bumped connections.<br>
> <br>
> But now I still can't imagine your infrastructure and how it must<br>
> work.<br>
> <br>
>> Also, must my https client still send a CONNECT message to<br>
>> Squid, or does it just connect to Squid's https_port at the TCP<br>
>> level, perform the SSL handshake, and then open a TCP connection<br>
>> to the reverse proxy?<br>
> <br>
> Still want to take a look on your infrastructure scheme.<br>
> <br>
> <br>
>> Thanks,<br>
> <br>
>> J. Bielski<br>
> <br>
> <br>
> <br>
>> _______________________________________________ squid-users<br>
>> mailing list squid-users@lists.squid-cache.org <br>
>> </font></tt><tt><font size="2"><a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></font></tt><tt><font size="2"><br>
> <br>
> _______________________________________________ squid-users mailing<br>
> list squid-users@lists.squid-cache.org <br>
> </font></tt><tt><font size="2"><a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></font></tt><tt><font size="2"><br>
> <br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
iQEcBAEBAgAGBQJU81GrAAoJENNXIZxhPexGPwkIAJrQAngPDCkylOCIb/IqYlkp<br>
JmCW/lr2JFcH48Zr954hi7six/uduwfNeTtZsd2Cz8JVW3pqQSIrleuF0B7/7C5H<br>
K+mDN6fQ3yQv9EjWTP1cRRdr+/OXQyWOPLoACUCz52SRvwAt1SnY9malavmnJPHS<br>
Aoj+vGTKSM4IasULA0Vnjm3gRjN6BWrUqoXZm1ODygflGXSJnqdm+8t9RhZIHcsl<br>
E1p9Q/hB1IJPrZU67YtgLHgg0MkOcQQzcJ/jzlPnlfOAFt0MPy8mC03YkcV4888a<br>
KHKXElzUbCDziSbG+L5Fz2zuLlQXoDc0ZqHSSB8iNYuB5UWpSZLXWXJ55yiDUBI=<br>
=xwxI<br>
-----END PGP SIGNATURE-----<br>
<br>
</font></tt><br>
</body></html>