<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Thu, 2015-04-23 at 17:18 +0930, Michael Hendrie wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE TYPE=CITE>
On 23 Apr 2015, at 4:28 pm, Michael Hendrie <<A HREF="mailto:michael@hendrie.id.au">michael@hendrie.id.au</A>> wrote:
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE TYPE=CITE>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BLOCKQUOTE TYPE=CITE>
On 23 Apr 2015, at 4:21 pm, Amos Jeffries <<A HREF="mailto:squid3@treenet.co.nz">squid3@treenet.co.nz</A>> wrote:<BR>
<BR>
On 23/04/2015 6:29 p.m., Michael Hendrie wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
Hi All<BR>
<BR>
I’ve been running squid-3.4.x in tproxy mode with ssl_bump<BR>
server-first for some time and has been working great.<BR>
<BR>
I have just moved to 3.5.3 to use peek to overcome some issues with<BR>
sites that require SNI to serve up the correct certificate. In most<BR>
cases this is work well however I seem to have an issue that (so far)<BR>
only effects the Safari web browser with certain sites. As an<BR>
example, <A HREF="https://twitter.com">https://twitter.com</A> <<A HREF="https://twitter.com/">https://twitter.com/</A>> and<BR>
<A HREF="https://www.openssl.org">https://www.openssl.org</A> <<A HREF="https://www.openssl.org/">https://www.openssl.org/</A>> will result in a<BR>
Safari error page “can’t establish a secure connection with the<BR>
server”. There is also a correlating entry in the cache.log 'Error<BR>
negotiating SSL connection on FD 45: error:140A1175:SSL<BR>
routines:SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback (1/-1)’<BR>
</BLOCKQUOTE>
<BR>
Please try the latest snapshot of 3.5 series. There are some TLS session<BR>
resume and SNI bug fixes.<BR>
</BLOCKQUOTE>
<BR>
Thanks Amos, but I did try squid-3.5.3-20150420-r13802 before posting….any other suggestions?<BR>
<BR>
Michael
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
OK, I seem to have resolved this now, for the benefit of everyone else on the list:
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
In the above tests the generated certificate was being signed by a RootCA that was installed as trusted in the browser certificate store.
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
I had previously noticed in my test environment (and thought completely unrelated) that bumped requests using the new peek/bump in 3.5.x were not sending the entire certificate chain to the browser but since they trusted the RootCA that was fine. In my production environment however I use an IntermediateCA to sign the bumped requests, this causes a browser error as the clients only trust the RootCA. As part of investigation to resolve this, I found that adding ‘cafile=/path/to/signing_ca_bundle’ to the ‘https_port' line (which in my config is exactly the same file as ‘cert=‘) that all certs are sent to the client, and I no longer face the issue with Safari and <A HREF="https://twitter.com">https://twitter.com</A> or <A HREF="https://www.openssl.org">https://www.openssl.org</A> regardless of using RootCA or InterCA to sign bumped requests.
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Not sure why but ‘ssl_bump server-first’ sends the entire chain without specifying ‘cafile=‘ and ‘ssl_bump peek/bump’ doesn’t…but anyway my problem is solved!
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Michael
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<PRE>
_______________________________________________
squid-users mailing list
<A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A>
<A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A>
</PRE>
</BLOCKQUOTE>
<BR>
Michael,<BR>
<BR>
Could you post your entire config here if possible? Many of us continue to face challenges with ssl_bump and a working config would be great. Thank you.<BR>
<BR>
James
</BODY>
</HTML>