<html><head></head><body>I just thought of something else. First of all I'm new to squid and I am not aware of 10% of the things its capable of yet so I will ask. <br>
<br>
Is squid capable of adding custom SNIs? Like could I have it so <a href="http://gmail.com">gmail.com</a> is added to the certificate as a subject alternate name EVEN though the original certificate doesn't contain it? If such a thing is possible I would love to know the term for it so I can do some searches. <br>
<br>
Appreciate it!<br><br><div class="gmail_quote">On May 27, 2015 12:15:37 PM EDT, Michael Monette <mmonette@2keys.ca> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Has anyone been able to configure Squid in a way so that if you type <a href="https://gmail.com">https://gmail.com</a> in your browser, you are NOT presented with the "OMG HSTS I refuse to load anything" page? When I go to <a href="https://gmail.com">https://gmail.com</a>, I get an invalid certificate because the cert is for <a href="http://mail.google.com">mail.google.com</a>, issued by my CA. If I go to <a href="https://mail.google.com">https://mail.google.com</a>, the cert is beautifully green. Why can't squid detect that <a href="http://gmail.com">gmail.com</a> is redirecting my browser to <a href="http://mail.google.com">mail.google.com</a> and generate the cert accordingly?<br /><br />Even configuring an acl for <a href="http://gmail.com">gmail.com</a> doesn't work. It seems like even though I am punching <a href="https://gmail.com">https://gmail.com</a> in my browser, Squid detects it as though I am typing "<a
href="https://mail.google.com">https://mail.google.com</a>" in my browser and is ignoring any ACLs I have setup specifically for "<a href="http://gmail.com">gmail.com</a>".<br /><br />I can't be the only one with this issue?<br /><br /><br /><br />I've also attempted to do:<br /><br />acl bl1 <a href="http://gmail.com">gmail.com</a> <a href="http://moz.com">moz.com</a><br />always_direct allow bl1 <- from what I understand this bypasses squid and tells my browser to get the cert right from the site. Maybe I am wrong.<br /><br />But certificates still come from Squid, so I don't see any effect from that line.<br /><br />Here's my config, lots of garbage in there since I have been trying everything i can think of to get this working. I want to add that for my acl called BL1, the only one that works is <a href="http://moz.com">moz.com</a> . They are part of the same ACL line, so if one works, they should all work. Except they do not.<br /><br />Thanks in advance.<br /><br />cat
/etc/squid/squid.conf<br /><br />~~<br /><br />debug_options ALL,9<br /><br />acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a> # RFC1918 possible internal network<br />acl localnet src <a href="http://172.16.0.0/12">172.16.0.0/12</a> # RFC1918 possible internal network<br />acl localnet src <a href="http://192.168.0.0/16">192.168.0.0/16</a> # RFC1918 possible internal network<br />acl localnet src fc00::/7 # RFC 4193 local private network range<br />acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines<br /><br />acl SSL_ports port 443<br />acl Safe_ports port 80 # http<br />acl Safe_ports port 21 # ftp<br />acl Safe_ports port 443 # https<br />acl Safe_ports port 70 # gopher<br />acl Safe_ports port 210 # wais<br />acl Safe_ports port 1025-65535 # unregistered ports<br />acl Safe_ports port 280 # http-mgmt<br />acl Safe_ports port 488 # gss-http<br />acl Safe_ports port 591 # filemaker<br />acl Safe_ports port 777 # multiling
http<br />acl CONNECT method CONNECT<br /><br /><br />http_access deny !Safe_ports<br /><br />http_access deny CONNECT !SSL_ports<br /><br />http_access allow localhost manager<br />http_access deny manager<br /><br />acl step1 at_step SslBump1<br />acl step2 at_step SslBump2<br />acl step3 at_step SslBump3<br /><br />ssl_bump peek step1 all<br />ssl_bump bump step2 all<br />ssl_bump bump step3 all<br /><br />acl bl1 dstdomain <a href="http://gmail.com">gmail.com</a> <a href="http://mail.google.com">mail.google.com</a> <a href="http://accounts.google.com">accounts.google.com</a> <a href="http://moz.com">moz.com</a><br />#acl bl1 url_regex -i ^http(s)?://<a href="http://gmail.com">gmail.com</a><br />#acl bl2 url_regex -i ^http(s)?://([a-zA-Z]+).<a href="http://gmail.com">gmail.com</a>.*<br />#acl bl3 url_regex -i ^http(s)?://<a href="http://moz.com">moz.com</a>.*<br />#acl bl4 url_regex -i <a href="http://moz.com">moz.com</a><br />deny_info <a href="http://ask.com">http://ask.com</a>
bl1 # I was testing redirecting stuff, but since the acl is not even picked up, this stuff is useless.<br />http_reply_access deny bl1 # useless<br />#http_access deny bl1 <br />#http_access deny bl1 CONNECT<br /><br />http_access allow localnet<br />http_access allow localhost<br /><br />http_access allow all<br /><br />http_port 3128 accel vhost allow-direct<br /><br />#https_port 3129 transparent ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myca.pem key=/etc/squid/ssl_cert/myca.pem options=NO_SSLv3<br />https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myca.pem key=/etc/squid/ssl_cert/myca.pem options=NO_SSLv3<br /><br />sslproxy_cert_error allow all<br />sslproxy_flags DONT_VERIFY_PEER<br /><br />sslproxy_options NO_SSLv2<br />sslproxy_options NO_SSLv3<br /><br />sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB<br />sslcrtd_children 8
startup=1 idle=1<br /><br />#cache_dir ufs /var/spool/squid 100 16 256<br />coredump_dir /var/spool/squid<br /><br />refresh_pattern ^ftp: 1440 20% 10080<br />refresh_pattern ^gopher: 1440 0% 1440<br />refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br />refresh_pattern . 0 20% 4320<br /><br /><br />Mike<br /><hr /><br />squid-users mailing list<br />squid-users@lists.squid-cache.org<br /><a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>