<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
Thanks for this Amos....I will try and do more experimenting this week with more results.<BR>
<BR>
James<BR>
<BR>
On Tue, 2015-05-26 at 19:46 +1200, Amos Jeffries wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
On 26/05/2015 4:26 a.m., James Lay wrote:
<FONT COLOR="#737373">> So following advice and instructions on this page:</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> <A HREF="http://wiki.squid-cache.org/Features/DynamicSslCert">http://wiki.squid-cache.org/Features/DynamicSslCert</A></FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> I have set up my lab with explicit proxy by exporting http_proxy and</FONT>
<FONT COLOR="#737373">> https_proxy. After creating the self-signed root CA certificate above</FONT>
<FONT COLOR="#737373">> and creating the .der file for the client, here are my results:</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> From the squid side:</FONT>
<FONT COLOR="#737373">> 2015/05/25 10:02:20.161| Using certificate</FONT>
<FONT COLOR="#737373">> in /opt/etc/squid/certs/SquidCA.pem</FONT>
<FONT COLOR="#737373">> 2015/05/25 10:02:20.170| support.cc(1743) readSslX509CertificatesChain:</FONT>
<FONT COLOR="#737373">> Certificate is self-signed, will not be chained</FONT>
<FONT COLOR="#737373">> I get the below when I don't specify a CA with curl, otherwise when I do</FONT>
<FONT COLOR="#737373">> I get no error:</FONT>
<FONT COLOR="#737373">> 2015/05/25 09:21:02.229| Error negotiating SSL connection on FD 12:</FONT>
<FONT COLOR="#737373">> error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (1/0)</FONT>
If that error is displayed by Squid about the clients connection. Then I
believe it means the client is attempting to perform TLS authentication
to Squid using the CA you installed there. Which is not possible as the
CA is supposed to make the client trust Squid generated certs, not the
other way around.
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> And from the client side:</FONT>
<FONT COLOR="#737373">> root@kali:~/test# curl -v <A HREF="https://mail.slave-tothe-box.net">https://mail.slave-tothe-box.net</A></FONT>
<FONT COLOR="#737373">> * About to connect() to proxy 192.168.1.9 port 3129 (#0)</FONT>
<FONT COLOR="#737373">> * Trying 192.168.1.9...</FONT>
<FONT COLOR="#737373">> * connected</FONT>
<FONT COLOR="#737373">> * Connected to 192.168.1.9 (192.168.1.9) port 3129 (#0)</FONT>
<FONT COLOR="#737373">> * Establish HTTP proxy tunnel to mail.slave-tothe-box.net:443</FONT>
<FONT COLOR="#737373">>> CONNECT mail.slave-tothe-box.net:443 HTTP/1.1</FONT>
<FONT COLOR="#737373">>> Host: mail.slave-tothe-box.net:443</FONT>
<FONT COLOR="#737373">>> User-Agent: curl/7.26.0</FONT>
<FONT COLOR="#737373">>> Proxy-Connection: Keep-Alive</FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">> * Easy mode waiting response from proxy CONNECT</FONT>
<FONT COLOR="#737373">> < HTTP/1.1 200 Connection established</FONT>
<FONT COLOR="#737373">> < </FONT>
<FONT COLOR="#737373">> * Proxy replied OK to CONNECT request</FONT>
<FONT COLOR="#737373">> * successfully set certificate verify locations:</FONT>
<FONT COLOR="#737373">> * CAfile: none</FONT>
<FONT COLOR="#737373">> CApath: /etc/ssl/certs</FONT>
<FONT COLOR="#737373">> * SSLv3, TLS handshake, Client hello (1):</FONT>
<FONT COLOR="#737373">> * SSLv3, TLS handshake, Server hello (2):</FONT>
<FONT COLOR="#737373">> * SSLv3, TLS handshake, CERT (11):</FONT>
<FONT COLOR="#737373">> * SSLv3, TLS alert, Server hello (2):</FONT>
<FONT COLOR="#737373">> * SSL certificate problem: self signed certificate in certificate chain</FONT>
<FONT COLOR="#737373">> * Closing connection #0</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> And testing with specifying the .der file:</FONT>
<FONT COLOR="#737373">> root@kali:~/test# curl --cacert /etc/ssl/certs/SquidCA.der -v</FONT>
<FONT COLOR="#737373">> <A HREF="https://mail.slave-tothe-box.net">https://mail.slave-tothe-box.net</A></FONT>
<FONT COLOR="#737373">> * About to connect() to proxy 192.168.1.9 port 3129 (#0)</FONT>
<FONT COLOR="#737373">> * Trying 192.168.1.9...</FONT>
<FONT COLOR="#737373">> * connected</FONT>
<FONT COLOR="#737373">> * Connected to 192.168.1.9 (192.168.1.9) port 3129 (#0)</FONT>
<FONT COLOR="#737373">> * Establish HTTP proxy tunnel to mail.slave-tothe-box.net:443</FONT>
<FONT COLOR="#737373">>> CONNECT mail.slave-tothe-box.net:443 HTTP/1.1</FONT>
<FONT COLOR="#737373">>> Host: mail.slave-tothe-box.net:443</FONT>
<FONT COLOR="#737373">>> User-Agent: curl/7.26.0</FONT>
<FONT COLOR="#737373">>> Proxy-Connection: Keep-Alive</FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">> * Easy mode waiting response from proxy CONNECT</FONT>
<FONT COLOR="#737373">> < HTTP/1.1 200 Connection established</FONT>
<FONT COLOR="#737373">> < </FONT>
<FONT COLOR="#737373">> * Proxy replied OK to CONNECT request</FONT>
<FONT COLOR="#737373">> * error setting certificate verify locations:</FONT>
<FONT COLOR="#737373">> CAfile: /etc/ssl/certs/SquidCA.der</FONT>
<FONT COLOR="#737373">> CApath: /etc/ssl/certs</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> * Closing connection #0</FONT>
<FONT COLOR="#737373">> curl: (77) error setting certificate verify locations:</FONT>
<FONT COLOR="#737373">> CAfile: /etc/ssl/certs/SquidCA.der</FONT>
<FONT COLOR="#737373">> CApath: /etc/ssl/certs</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> I can confirm that the server is using a bona-fide certificate issued</FONT>
<FONT COLOR="#737373">> from StartSSL and works, so at this point I'm open to suggestions.</FONT>
<FONT COLOR="#737373">> Thank you.</FONT>
curl is complaining that the CA chain for the Squid-generted cert has a
self-signed CA. This is expected and desired behaviour if the
self-signed CA was sent by Squid.
The errors only occur when the self-signed CA is not sent by Squid, but
using the one installed on the client.
For that I believe you need to configure Squid to sign/generate using
the intermediate certificate. The self-signed root CA not configured in
Squid at all.
Like so:
A)
client Trust DB installed with self-signed root CA
squid.conf cert= configured with intermediary CA certificate
squid.conf cafile= configured with any other intermediary CA
certificates (in order back to root CA, but excluding it).
Squid generates per-connection certificate
OR:
B)
client Trust DB installed with self-signed root CA
squid.conf cert= configured with self-signed root CA
Squid generates per-connection certificate
Note that in (B) there is no intermediary certificate at all, and Squid
does not emit any CA chain to the client.
It works exactly the same way as the globally trusted CA do. But they
are contractually obliged to refuse giving out intermediary CA for
anyones use, or loose their status as trusted CA.
Amos
_______________________________________________
squid-users mailing list
<A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A>
<A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A>
</PRE>
</BLOCKQUOTE>
<BR>
<BR>
</BODY>
</HTML>