<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Tue, 2015-06-23 at 09:11 +0200, Klavs Klavsen wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
Hi James,
Did you ever find an answer for this?
James Lay wrote on 06/11/2015 02:16 AM:
<FONT COLOR="#737373">> All,</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> From the docs at:</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> <A HREF="http://wiki.squid-cache.org/Features/SslPeekAndSplice">http://wiki.squid-cache.org/Features/SslPeekAndSplice</A></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> *peek*</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> step1, step2</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> Receive SNI and client certificate (step1), or server certificate</FONT>
<FONT COLOR="#737373">> (step2) while preserving the possibility of splicing the connection.</FONT>
<FONT COLOR="#737373">> Peeking at the server certificate usually precludes future bumping of</FONT>
<FONT COLOR="#737373">> the connection (see Limitations). This action is the focus of this project.</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> *stare*</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> step1, step2</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> Receive SNI and client certificate (step1), or server certificate</FONT>
<FONT COLOR="#737373">> (step2) while preserving the possibility of bumping the connection.</FONT>
<FONT COLOR="#737373">> Staring at the server certificate usually precludes future splicing of</FONT>
<FONT COLOR="#737373">> the connection. Currently, we are not aware of any work being done to</FONT>
<FONT COLOR="#737373">> support this action.</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> I see a lot of:</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> ssl_bump peek all</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> Does this perform both step1 with SNI and client cert, AND server cert?</FONT>
<FONT COLOR="#737373">> Thank you.</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> James</FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">></FONT>
<FONT COLOR="#737373">> _______________________________________________</FONT>
<FONT COLOR="#737373">> squid-users mailing list</FONT>
<FONT COLOR="#737373">> <A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A></FONT>
<FONT COLOR="#737373">> <A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></FONT>
<FONT COLOR="#737373">></FONT>
</PRE>
</BLOCKQUOTE>
<BR>
Hi Klavs,<BR>
<BR>
I did not. I can tell you in my testing that:<BR>
<BR>
ssl_bump peek step1 all<BR>
ssl_bump peek step2 all<BR>
<BR>
versus<BR>
<BR>
ssl_bump peek all<BR>
<BR>
Did not give me the same results, so I'm going to assume a single statement only performs SNI lookup, but maybe someone else on the list has a better answer.<BR>
<BR>
James
</BODY>
</HTML>