<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="font-family: Monospace;">
<div>... and more ...</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div style="color: rgb(0, 0, 0);">I don't know what is going wrong or what is missing in the configuration.</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">Both Squid and client are able to connect to 212.45.105.89:443 with</div>
<div style="color: rgb(0, 0, 0);"><span style="color: rgb(255, 0, 0);"># openssl s_client -connect 212.45.105.89:443</span></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">CONNECTED(00000003)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">depth=3 C = ZA, ST = Western Cape, L = Cape Town, O = Thawte Consulting cc, OU = Certification Services Division, CN = Thawte Premium Server CA, emailAddress = <a href="mailto:premium-server@thawte.com">premium-server@thawte.com</a></font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">verify return:1</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">depth=2 C = US, O = "thawte, Inc.", OU = Certification Services Division, OU = "(c) 2006 thawte, Inc. - For authorized use only", CN = thawte Primary Root CA</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">verify return:1</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">depth=1 C = US, O = "Thawte, Inc.", CN = Thawte SSL CA</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">verify return:1</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">depth=0 C = DE, ST = Berlin, L = Berlin, O = bettermarks GmbH, CN = *.bettermarks.com</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">verify return:1</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">---</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Certificate chain</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> 0 s:/C=DE/ST=Berlin/L=Berlin/O=bettermarks GmbH/CN=*.bettermarks.com</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> i:/C=US/O=Thawte, Inc./CN=Thawte SSL CA</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> 1 s:/C=US/O=Thawte, Inc./CN=Thawte SSL CA</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> i:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> 2 s:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> i:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server <a href="mailto:CA/emailAddress=premium-server@thawte.com">CA/emailAddress=premium-server@thawte.com</a></font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">---</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Server certificate</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">-----BEGIN CERTIFICATE-----</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">MIIEljCCA36gAwIBAgIQDgGSShcLYslr7WvI8BNFWDANBgkqhkiG9w0BAQUFADA8</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMVGhhd3RlLCBJbmMuMRYwFAYDVQQDEw1U</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">aGF3dGUgU1NMIENBMB4XDTEzMTIyNDAwMDAwMFoXDTE2MDEyMzIzNTk1OVowZjEL</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">MAkGA1UEBhMCREUxDzANBgNVBAgTBkJlcmxpbjEPMA0GA1UEBxQGQmVybGluMRkw</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">FwYDVQQKFBBiZXR0ZXJtYXJrcyBHbWJIMRowGAYDVQQDFBEqLmJldHRlcm1hcmtz</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANZNN7SeA27FgU3W</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">QEHHfgQhTnJ3zwviubXSU3vppqDmguuMfdR0NIqHQv3ds7QdEK0jik3rDzAzadBD</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">mQDmN4IIbp1IgFKuI9IWF/6jXv3ViNwdbIadUxPGHqa/SYO4XPFA3wpMBjHymvK2</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">GpXMD7vp7MxBCydtod5SY5kft6Y1T3jgIAjS2BUhXS8uQCra2kXLc2Jwu/JX5Asa</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">oQvnGhyltpnEQZto5MK1zeGaEi/AoJZOsrIv3nVULTyIqLqI33BD6Vru8kXp939k</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">rofE63723dA4YHhtVmrzn55milysxMZnR6XjdywFF41xFqed6dmHGOnGAkAJicqZ</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">QCOF2+cCAwEAAaOCAWgwggFkMBwGA1UdEQQVMBOCESouYmV0dGVybWFya3MuY29t</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">MAkGA1UdEwQCMAAwQgYDVR0gBDswOTA3BgpghkgBhvhFAQc2MCkwJwYIKwYBBQUH</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">AgEWG2h0dHBzOi8vd3d3LnRoYXd0ZS5jb20vY3BzLzAOBgNVHQ8BAf8EBAMCBaAw</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">HwYDVR0jBBgwFoAUp6KDuzRFQD381TBPErk+oQGf9tswOgYDVR0fBDMwMTAvoC2g</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">K4YpaHR0cDovL3N2ci1vdi1jcmwudGhhd3RlLmNvbS9UaGF3dGVPVi5jcmwwHQYD</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGkGCCsGAQUFBwEBBF0wWzAiBggr</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">BgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTA1BggrBgEFBQcwAoYpaHR0</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">cDovL3N2ci1vdi1haWEudGhhd3RlLmNvbS9UaGF3dGVPVi5jZXIwDQYJKoZIhvcN</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">AQEFBQADggEBAFXVX0KqaJHiMZo7PjbWSfXunaZYdV4KIjpYlfyWBJ8Gb7p3e+4j</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">aKrs3Nq+ffRPnm+TtbJWRcJ0ssHSymJNiDw6UfYprNkIiOzgPisY8g32yPjUIekf</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">GPm9RaAO0ml9vQH/cNJjw4+Da249W0PYbkGWngozYqH9bOYIu88kqCVUePeHzQjI</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">rI9kUiXJOUZYwIhsdtFNiPbvLHyYdvWLsCvLYAk2hbJd2L1j7Z3YdO+Lf+gK+kj+</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">rgMji14ibaWx1iKfVJ7RaNBkNWsX3aE7dlBdx35Tc30Hy1eADq029ae+41oDEO8y</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">4f38eLFMYfXzHx0j1Td0WAXMGK3Nyhiquck=</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">-----END CERTIFICATE-----</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">subject=/C=DE/ST=Berlin/L=Berlin/O=bettermarks GmbH/CN=*.bettermarks.com</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">issuer=/C=US/O=Thawte, Inc./CN=Thawte SSL CA</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">---</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">No client certificate CA names sent</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">---</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">SSL handshake has read 3618 bytes and written 607 bytes</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">---</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">New, TLSv1/SSLv3, Cipher is AES256-SHA256</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Server public key is 2048 bit</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Secure Renegotiation IS supported</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Compression: NONE</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Expansion: NONE</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">SSL-Session:</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Protocol : TLSv1.2</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Cipher : AES256-SHA256</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Session-ID: D4883E09C2BAD02BACEB79C87CB6B7583D2D907FE6DA11290920CC6D4AEFD98D</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Session-ID-ctx:</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Master-Key: 8A2CE177DFFD2FDD36124CF95CE4BA09D768FE919F001FE87B68ADF7881BFF9C50DDFDB0ADDC223AE34E58F30663935C</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Key-Arg : None</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Krb5 Principal: None</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> PSK identity: None</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> PSK identity hint: None</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Start Time: 1447183108</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Timeout : 300 (sec)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> Verify return code: 0 (ok)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">---</font></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">Is there anything I can do in order to address my problem? More or other debugging options? Unfortunatily I am not</div>
<div style="color: rgb(0, 0, 0);">very familiar with Squid.</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">The next step would be to get CloudFront working. To be precise: I want to use a further hostname cdn.bettermarks.com</div>
<div style="color: rgb(0, 0, 0);">that is only a CNAME for d2gs9kr1131uxo.cloudfront.net. CloudFront provides several IP addresses, each of them is shared</div>
<div style="color: rgb(0, 0, 0);">by multiple hostnames/domains. There is no way to make a https connection to CloudFront without SNI.</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">Best regards,</div>
<div style="color: rgb(0, 0, 0);">Stefan</div>
<div><br>
</div>
</div>
<div><br>
</div>
<div>Am Dienstag, den 10.11.2015, 08:49 -0700 schrieb Alex Rousskov:</div>
<blockquote type="cite">
<div>On 11/10/2015 07:05 AM, Stefan Kutzke wrote:</div>
<div><br>
</div>
<blockquote type="cite">
<div>My assumption is that I have to use in Squid's config:</div>
</blockquote>
<div><br>
</div>
<blockquote type="cite">
<div>acl MYSITE ssl:server_name .mydomain.com</div>
<div>ssl_bump bump MYSITE</div>
<div>ssl_bump splice all</div>
</blockquote>
<div><br>
</div>
<blockquote type="cite">
<div>This results in tunneling all https traffic, nothing will be bumped and</div>
<div>cached. </div>
</blockquote>
<div><br>
</div>
<div>Yes, probably because MYSITE (ssl::server_name) often needs SNI and SNI</div>
<div>is not available during step1 when MYSITE is evaluated in your config.</div>
<div>In other words, your config is equivalent to</div>
<div><br>
</div>
<div> ssl_bump splice all</div>
<div><br>
</div>
<div>unless reverse DNS works perfectly well.</div>
<div><br>
</div>
<div><br>
</div>
<blockquote type="cite">
<div>I'm a little bit confused about the documentation:</div>
</blockquote>
<div><br>
</div>
<blockquote type="cite">
<div>Under the headline "Processing steps":</div>
<div>*Step 2:*</div>
<div> 1. Get TLS clientHello info, including *SNI* where available. </div>
</blockquote>
<div><br>
</div>
<div><br>
</div>
<blockquote type="cite">
<div>Under the headline "Actions":</div>
<div>peek/stare Receive client *SNI (step1)*, ...</div>
</blockquote>
<div><br>
</div>
<div><br>
</div>
<div>I know it is confusing, but I cannot find a better way to explain this</div>
<div>in brief documentation without pictures. Improvements are welcomed. The</div>
<div>key here is that ssl_bump rules are evaluated at the end of a step and</div>
<div>usually allow Squid to do something at the beginning of the next step.</div>
<div><br>
</div>
<div>For example, during step1, Squid does not have SNI. If a peek rule</div>
<div>matches during step1, then Squid proceeds to step2. At the beginning of</div>
<div>step2, Squid gets SNI. Thus, a step1 peek rule controls whether Squid</div>
<div>will get SNI (during step2).</div>
<div><br>
</div>
<div><br>
</div>
<blockquote type="cite">
<div>Is it possible to achieve my goal with Squid in transparent mode?</div>
</blockquote>
<div><br>
</div>
<div>I should be possible, but I do not know whether anybody has done exactly</div>
<div>that so there could be some minor bugs along the way. You need</div>
<div>configuration suggested by Sebastian and the latest Squid you can build.</div>
<div><br>
</div>
<div><br>
</div>
<div>HTH,</div>
<div><br>
</div>
<div>Alex.</div>
<div><br>
</div>
</blockquote>
</body>
</html>