<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
More probably this is bug
<a class="moz-txt-link-freetext" href="http://bugs.squid-cache.org/show_bug.cgi?id=4188">http://bugs.squid-cache.org/show_bug.cgi?id=4188</a>.<br>
<br>
12.11.15 18:04, Steve Hill пишет:<br>
<span style="white-space: pre;">> On 12/11/15 09:04, Eugene M.
Zheganin wrote:<br>
><br>
>> I decided to intercept the HTTPS traffic on my production
squids from<br>
>> proxy-unware clients to be able to tell them there's a
proxy and they<br>
>> should configure one.<br>
>> So I'm doing it like (the process of forwarding using
FreeBSD pf is not<br>
>> shown here):<br>
>><br>
>> ===Cut===<br>
>> acl unauthorized proxy_auth stringthatwillnevermatch<br>
>> acl step1 at_step sslBump1<br>
>><br>
>> https_port 127.0.0.1:3131 intercept ssl-bump<br>
>> cert=/usr/local/etc/squid/certs/squid.cert.pem<br>
>> generate-host-certificates=on
dynamic_cert_mem_cache_size=4MB<br>
>> dhparams=/usr/local/etc/squid/certs/dhparam.pem<br>
>> https_port [::1]:3131 intercept ssl-bump<br>
>> cert=/usr/local/etc/squid/certs/squid.cert.pem<br>
>> generate-host-certificates=on
dynamic_cert_mem_cache_size=4MB<br>
>> dhparams=/usr/local/etc/squid/certs/dhparam.pem<br>
>><br>
>> ssl_bump peek step1<br>
>> ssl_bump bump unauthorized<br>
>> ssl_bump splice all<br>
>> ===Cut===<br>
>><br>
>> Almost everything works, except that squid for some
reason is generating<br>
>> certificates in this case for IP addresses, not names, so
the browser<br>
>> shows a warning abount certificate being valid only for
IP, and not name.<br>
><br>
> proxy_auth won't work on intercepted traffic and will
therefore always return false, so as far as I can see you're
always going to peek and then splice. i.e. you're never going to
bump, so squid should never be generating a forged certificate.<br>
><br>
> You say that Squid _is_ generating a forged certificate, so
something else is going on to cause it to do that. My first guess
is that Squid is generating some kind of error page due to some
http_access rules which you haven't listed, and is therefore
bumping.<br>
><br>
> Two possibilities spring to mind for the certificate being
for the IP address rather than for the name:<br>
> 1. The browser isn't bothering to include an SNI in the SSL
handshake (use wireshark to confirm). In this case, Squid has no
way to know what name to stick in the cert, so will just use the
IP instead.<br>
> 2. The bumping is happening in step 1 instead of step 2 for
some reason. See:
<a class="moz-txt-link-freetext" href="http://bugs.squid-cache.org/show_bug.cgi?id=4327">http://bugs.squid-cache.org/show_bug.cgi?id=4327</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJWRIqmAAoJENNXIZxhPexGNGYIAIjJEGvbSa5WovjyrdzsBM+/
<br>
f3ucdM4x8e4CZtNxOhOoLlLOZdsG0vr6aiHDDOcKhPGL9wg0goQnvToaZguqtcDG
<br>
JcSLA3iwR/GI8RmTmmODsqDOyxLAVQx6JjWQKQIkYE5nvCOh7orSnh2oaUHqkG2P
<br>
0bxMI2NR6RB977rQPiZlN89yp1wdd0C99iBvEs6chifoTMrSQzKstEs31k8zt1Ae
<br>
ZTM/aEMnqXf0GiDbayXcPMYoQ6w9/fEpQ5wA/mCQSE4ZH71zPsChPqCcA2jp8gU5
<br>
VR4+ZQeLklSEiGweun8Yk1LAupTf7APRV+H2yX/m6ElXXkMMDFu5OM9plMQHFKo=
<br>
=LXF6
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>