<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
Ah, misunderstand.<br>
<br>
Error you got means that target server certificate's CA is not
visible by Squid. Or for client.<br>
<br>
Huh. :) I had thought that Squid suddenly turned into a hackware
:)))))))))))<br>
<br>
25.05.15 22:26, James Lay пишет:<br>
<span style="white-space: pre;">> So following advice and
instructions on this page:<br>
><br>
> <a class="moz-txt-link-freetext" href="http://wiki.squid-cache.org/Features/DynamicSslCert">http://wiki.squid-cache.org/Features/DynamicSslCert</a><br>
><br>
> I have set up my lab with explicit proxy by exporting
http_proxy and<br>
> https_proxy. After creating the self-signed root CA
certificate above<br>
> and creating the .der file for the client, here are my
results:<br>
><br>
> From the squid side:<br>
> 2015/05/25 10:02:20.161| Using certificate<br>
> in /opt/etc/squid/certs/SquidCA.pem<br>
> 2015/05/25 10:02:20.170| support.cc(1743)
readSslX509CertificatesChain:<br>
> Certificate is self-signed, will not be chained<br>
> I get the below when I don't specify a CA with curl,
otherwise when I do<br>
> I get no error:<br>
> 2015/05/25 09:21:02.229| Error negotiating SSL connection on
FD 12:<br>
> error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert
unknown ca (1/0)<br>
><br>
> And from the client side:<br>
> root@kali:~/test# curl -v <a class="moz-txt-link-freetext" href="https://mail.slave-tothe-box.net">https://mail.slave-tothe-box.net</a><br>
> * About to connect() to proxy 192.168.1.9 port 3129 (#0)<br>
> * Trying 192.168.1.9...<br>
> * connected<br>
> * Connected to 192.168.1.9 (192.168.1.9) port 3129 (#0)<br>
> * Establish HTTP proxy tunnel to mail.slave-tothe-box.net:443<br>
>> CONNECT mail.slave-tothe-box.net:443 HTTP/1.1<br>
>> Host: mail.slave-tothe-box.net:443<br>
>> User-Agent: curl/7.26.0<br>
>> Proxy-Connection: Keep-Alive<br>
>><br>
> * Easy mode waiting response from proxy CONNECT<br>
> < HTTP/1.1 200 Connection established<br>
> < <br>
> * Proxy replied OK to CONNECT request<br>
> * successfully set certificate verify locations:<br>
> * CAfile: none<br>
> CApath: /etc/ssl/certs<br>
> * SSLv3, TLS handshake, Client hello (1):<br>
> * SSLv3, TLS handshake, Server hello (2):<br>
> * SSLv3, TLS handshake, CERT (11):<br>
> * SSLv3, TLS alert, Server hello (2):<br>
> * SSL certificate problem: self signed certificate in
certificate chain<br>
> * Closing connection #0<br>
><br>
> And testing with specifying the .der file:<br>
> root@kali:~/test# curl --cacert /etc/ssl/certs/SquidCA.der -v<br>
> <a class="moz-txt-link-freetext" href="https://mail.slave-tothe-box.net">https://mail.slave-tothe-box.net</a><br>
> * About to connect() to proxy 192.168.1.9 port 3129 (#0)<br>
> * Trying 192.168.1.9...<br>
> * connected<br>
> * Connected to 192.168.1.9 (192.168.1.9) port 3129 (#0)<br>
> * Establish HTTP proxy tunnel to mail.slave-tothe-box.net:443<br>
>> CONNECT mail.slave-tothe-box.net:443 HTTP/1.1<br>
>> Host: mail.slave-tothe-box.net:443<br>
>> User-Agent: curl/7.26.0<br>
>> Proxy-Connection: Keep-Alive<br>
>><br>
> * Easy mode waiting response from proxy CONNECT<br>
> < HTTP/1.1 200 Connection established<br>
> < <br>
> * Proxy replied OK to CONNECT request<br>
> * error setting certificate verify locations:<br>
> CAfile: /etc/ssl/certs/SquidCA.der<br>
> CApath: /etc/ssl/certs<br>
><br>
> * Closing connection #0<br>
> curl: (77) error setting certificate verify locations:<br>
> CAfile: /etc/ssl/certs/SquidCA.der<br>
> CApath: /etc/ssl/certs<br>
><br>
><br>
> I can confirm that the server is using a bona-fide
certificate issued<br>
> from StartSSL and works, so at this point I'm open to
suggestions.<br>
> Thank you.<br>
><br>
> James<br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJVY1PuAAoJENNXIZxhPexG9WoH/09V9BB8VzXFGiJK/Sa3q29x
<br>
NdsaVmgS0SvytG+0aiVowJ4c6qf+IiEuqJiS6ymcBphPdVuvnY4pNcjpNA1Ke0AR
<br>
Kvm1KWswvSXyZvrVC4zo4Vsqd1pKFY9XBcy8N/S7l61DSsrPQfChXL0w5E2DPJ7I
<br>
fM9PvzDglshT7o1fNnfKObVsvo/CtNXJ8tc/pS78uZTeECW55QjhY55IAaQAUI2V
<br>
/uAyxxE7H73+qAlxlGHDVRzIcEN8wx/bqhVcMPNOoDy47PvN0W7XtW8EgPcOO6ej
<br>
lwDsmPrW8GhLhSWHe003aqQV0BJ8cSSjrL0HooQEyD5iTUfZUQLBKkE+0+XPZRE=
<br>
=Zb+F
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>