<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Mon, 2015-06-01 at 12:12 +1000, Nathan Hoad wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
Hello,
Here are some excerpts of what I've used, and an example Python helper:
https_port 60099 intercept ssl-bump tcpkeepalive
cert=/path/to/cert.pem key=/path/to/key.pem options=NO_SSLv2,NO_SSLv3
generate-host-certificates=on
external_acl_type sni ttl=30 concurrency=X children-max=Y
children-startup=Z %ssl::>sni /path/to/your/helper
acl sni_exclusions external sni
acl tcp_level at_step SslBump1
acl client_hello_peeked at_step SslBump2
ssl_bump peek tcp_level all
ssl_bump splice client_hello_peeked sni_exclusions
ssl_bump bump all
Helper:
import sys
line = sys.stdin.read()
# run loop until an empty read, which indicates the process should shut down.
while line:
concurrency_id, sni = line.split()
if sni == 'wellsfargo.com':
sys.stdout.write('%s OK\n' % concurrency_id)
else:
sys.stdout.write('%s ERR\n' % concurrency_id)
line = sys.stdin.read()
Hope that helps,
Nathan.
On 30 May 2015 at 01:14, James Lay <<A HREF="mailto:jlay@slave-tothe-box.net">jlay@slave-tothe-box.net</A>> wrote:
<FONT COLOR="#737373">> On 2015-05-29 08:57 AM, Nathan Hoad wrote:</FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">>> Yes, I have it working on about a dozen deployments so far, using an</FONT>
<FONT COLOR="#737373">>> external ACL to make bumping decisions based on the SNI server name</FONT>
<FONT COLOR="#737373">>> and a few other things. No complaints from me, it Just Works.</FONT>
<FONT COLOR="#737373">>> On 29/05/2015 5:50 pm, "sp_" <<A HREF="mailto:apani@yandex.ru">apani@yandex.ru</A>> wrote:</FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">>>> Hello,</FONT>
<FONT COLOR="#737373">>>></FONT>
<FONT COLOR="#737373">>>> does anyone have the working squid 3.5 with intercept + https?</FONT>
<FONT COLOR="#737373">>>> I've googled a lot, but seems there is no any positive experience</FONT>
<FONT COLOR="#737373">>>> with it.</FONT>
<FONT COLOR="#737373">>>></FONT>
<FONT COLOR="#737373">>>> --</FONT>
<FONT COLOR="#737373">>>> View this message in context:</FONT>
<FONT COLOR="#737373">>>></FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">>> <A HREF="http://squid-web-proxy-cache.1019090.n4.nabble.com/ssl-bump-and-SNI-tp4670207p4671432.html">http://squid-web-proxy-cache.1019090.n4.nabble.com/ssl-bump-and-SNI-tp4670207p4671432.html</A></FONT>
<FONT COLOR="#737373">>>></FONT>
<FONT COLOR="#737373">>>> [1]</FONT>
<FONT COLOR="#737373">>>> Sent from the Squid - Users mailing list archive at Nabble.com.</FONT>
<FONT COLOR="#737373">>>> _______________________________________________</FONT>
<FONT COLOR="#737373">>>> squid-users mailing list</FONT>
<FONT COLOR="#737373">>>> <A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A></FONT>
<FONT COLOR="#737373">>>> <A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A> [2]</FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">>> Links:</FONT>
<FONT COLOR="#737373">>> ------</FONT>
<FONT COLOR="#737373">>> [1]</FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">>> <A HREF="http://squid-web-proxy-cache.1019090.n4.nabble.com/ssl-bump-and-SNI-tp4670207p4671432.html">http://squid-web-proxy-cache.1019090.n4.nabble.com/ssl-bump-and-SNI-tp4670207p4671432.html</A></FONT>
<FONT COLOR="#737373">>> [2] <A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></FONT>
<FONT COLOR="#737373">>></FONT>
<FONT COLOR="#737373">>> _______________________________________________</FONT>
<FONT COLOR="#737373">>> squid-users mailing list</FONT>
<FONT COLOR="#737373">>> <A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A></FONT>
<FONT COLOR="#737373">>> <A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> Nathan,</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> Care to post your config and external helper? I know I'd love to see</FONT>
<FONT COLOR="#737373">> concrete examples. Thank you.</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> James</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> _______________________________________________</FONT>
<FONT COLOR="#737373">> squid-users mailing list</FONT>
<FONT COLOR="#737373">> <A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A></FONT>
<FONT COLOR="#737373">> <A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></FONT>
</PRE>
</BLOCKQUOTE>
<BR>
Thank you Nathan.<BR>
<BR>
James
</BODY>
</HTML>