<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>So far as I know, hen sslbump is enabled for a port, for each dns name, squid save a cert generated according to dns name and signing key (from http_port configuration). So the next time, the generated cert can be fetched if the same dns host and configured signing key.<div><br></div><div>Now have a question on this:</div><div><br></div><div><br><div>
<p class="p1"><span class="s1">http_port</span><span class="s2"> </span><span class="s3">10045</span><span class="s2"> ssl-bump generate-host-certificates=</span><span class="s3">on</span><span class="s2"> dynamic_cert_mem_cache_size=4MB key=/opt/bg/deploy/squid/etc/mydlp/ssl/key_10045.pem cert=/opt/bg/deploy/squid/etc/mydlp/ssl/cert_10045.pem</span></p>
<p class="p1"><span class="s1">http_port</span><span class="s2"> </span><span class="s3">10046</span><span class="s2"> ssl-bump generate-host-certificates=</span><span class="s3">on</span><span class="s2"> dynamic_cert_mem_cache_size=4MB key=/opt/bg/deploy/squid/etc/mydlp/ssl/key_10046.pem cert=/opt/bg/deploy/squid/etc/mydlp/ssl/cert_10046.pem</span></p><p class="p1"><span class="s2"><br></span></p><p class="p1">I have two ports configured with SSLBUMP. Each port has its own CA signing key. The desired behavior is that, for the hostname www.foo.com, the certificate generated for the port should use key_10045, and the certificate generated for the port should use key_10046. It seems OK. </p><p class="p1"><br></p><p class="p1">But, if we look at the ssl_db, only the last generated certificate is cached for www.foo.com. Is it possible to cache the generated certificates by the host and signing key?</p><p class="p1"><br></p><p class="p1">Alex</p></div></div> </div></body>
</html>