<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
So following advice and instructions on this page:<BR>
<BR>
<A HREF="http://wiki.squid-cache.org/Features/DynamicSslCert">http://wiki.squid-cache.org/Features/DynamicSslCert</A><BR>
<BR>
I have set up my lab with explicit proxy by exporting http_proxy and https_proxy. After creating the self-signed root CA certificate above and creating the .der file for the client, here are my results:<BR>
<BR>
>From the squid side:<BR>
<TT>2015/05/25 10:02:20.161| Using certificate in /opt/etc/squid/certs/SquidCA.pem</TT><BR>
<TT>2015/05/25 10:02:20.170| support.cc(1743) readSslX509CertificatesChain: Certificate is self-signed, will not be chained</TT><BR>
I get the below when I don't specify a CA with curl, otherwise when I do I get no error:<BR>
<TT>2015/05/25 09:21:02.229| Error negotiating SSL connection on FD 12: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (1/0)</TT><BR>
<BR>
And from the client side:<BR>
<TT>root@kali:~/test# curl -v <A HREF="https://mail.slave-tothe-box.net">https://mail.slave-tothe-box.net</A></TT><BR>
<TT>* About to connect() to proxy 192.168.1.9 port 3129 (#0)</TT><BR>
<TT>* Trying 192.168.1.9...</TT><BR>
<TT>* connected</TT><BR>
<TT>* Connected to 192.168.1.9 (192.168.1.9) port 3129 (#0)</TT><BR>
<TT>* Establish HTTP proxy tunnel to mail.slave-tothe-box.net:443</TT><BR>
<TT>> CONNECT mail.slave-tothe-box.net:443 HTTP/1.1</TT><BR>
<TT>> Host: mail.slave-tothe-box.net:443</TT><BR>
<TT>> User-Agent: curl/7.26.0</TT><BR>
<TT>> Proxy-Connection: Keep-Alive</TT><BR>
<TT>> </TT><BR>
<TT>* Easy mode waiting response from proxy CONNECT</TT><BR>
<TT>< HTTP/1.1 200 Connection established</TT><BR>
<TT>< </TT><BR>
<TT>* Proxy replied OK to CONNECT request</TT><BR>
<TT>* successfully set certificate verify locations:</TT><BR>
<TT>* CAfile: none</TT><BR>
<TT> CApath: /etc/ssl/certs</TT><BR>
<TT>* SSLv3, TLS handshake, Client hello (1):</TT><BR>
<TT>* SSLv3, TLS handshake, Server hello (2):</TT><BR>
<TT>* SSLv3, TLS handshake, CERT (11):</TT><BR>
<TT>* SSLv3, TLS alert, Server hello (2):</TT><BR>
<TT>* SSL certificate problem: self signed certificate in certificate chain</TT><BR>
<TT>* Closing connection #0</TT><BR>
<BR>
And testing with specifying the .der file:<BR>
<TT>root@kali:~/test# curl --cacert /etc/ssl/certs/SquidCA.der -v <A HREF="https://mail.slave-tothe-box.net">https://mail.slave-tothe-box.net</A></TT><BR>
<TT>* About to connect() to proxy 192.168.1.9 port 3129 (#0)</TT><BR>
<TT>* Trying 192.168.1.9...</TT><BR>
<TT>* connected</TT><BR>
<TT>* Connected to 192.168.1.9 (192.168.1.9) port 3129 (#0)</TT><BR>
<TT>* Establish HTTP proxy tunnel to mail.slave-tothe-box.net:443</TT><BR>
<TT>> CONNECT mail.slave-tothe-box.net:443 HTTP/1.1</TT><BR>
<TT>> Host: mail.slave-tothe-box.net:443</TT><BR>
<TT>> User-Agent: curl/7.26.0</TT><BR>
<TT>> Proxy-Connection: Keep-Alive</TT><BR>
<TT>> </TT><BR>
<TT>* Easy mode waiting response from proxy CONNECT</TT><BR>
<TT>< HTTP/1.1 200 Connection established</TT><BR>
<TT>< </TT><BR>
<TT>* Proxy replied OK to CONNECT request</TT><BR>
<TT>* error setting certificate verify locations:</TT><BR>
<TT> CAfile: /etc/ssl/certs/SquidCA.der</TT><BR>
<TT> CApath: /etc/ssl/certs</TT><BR>
<BR>
<TT>* Closing connection #0</TT><BR>
<TT>curl: (77) error setting certificate verify locations:</TT><BR>
<TT> CAfile: /etc/ssl/certs/SquidCA.der</TT><BR>
<TT> CApath: /etc/ssl/certs</TT><BR>
<BR>
<BR>
I can confirm that the server is using a bona-fide certificate issued from StartSSL and works, so at this point I'm open to suggestions. Thank you.<BR>
<BR>
James
</BODY>
</HTML>