<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
Don't think so.<br>
<br>
Google's HTTPS's works for me without any alerts in Chrome :) With
bump! ;)<br>
<br>
03.01.16 2:12, Nir Krakowski пишет:<br>
<span style="white-space: pre;">> Its called certificate pinning:<br>
> <a class="moz-txt-link-freetext" href="https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning">https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning</a><br>
><br>
> Nir.<br>
><br>
> On Sat, Jan 2, 2016 at 9:11 PM, Alejandro Martinez
<a class="moz-txt-link-rfc2396E" href="mailto:ajm.martinez@gmail.com"><ajm.martinez@gmail.com></a><br>
> wrote:<br>
><br>
>> Hi all,<br>
>><br>
>> I'm using squid 3.5.12.<br>
>><br>
>> This is my relevant config:<br>
>><br>
>> *http_port 881*<br>
>> *http_port 880 intercept*<br>
>> *https_port 843 intercept ssl-bump
generate-host-certificates=on<br>
>> dynamic_cert_mem_cache_size=4MB
cert=/usr/local/squid/etc/cert.pem key=*<br>
>> */usr/local/squid/etc**/cert.pem
options=NO_SSLv3:NO_SSLv2<br>
>>
cipher=ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:AES128-SHA:RC4-SHA:HIGH:!aNULL:!MD5:!ADH*<br>
>> *sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s *<br>
>> */usr/local/squid/etc/**ssl/certs -M 4MB sslcrtd_children
8 startup=1<br>
>> idle=1*<br>
>><br>
>> *#### Denied Users*<br>
>> *acl equipos_denegados src
"**/usr/local/squid/etc**/equipos_denegados"*<br>
>> *http_access deny equipos_denegados*<br>
>> *deny_info DENY equipos_denegados*<br>
>><br>
>> *#### Allowed users*<br>
>> *acl equipos_permitidos src
"/**usr/local/squid/etc**/equipos_permitidos"*<br>
>> *http_access allow equipos_permitidos*<br>
>> *####*<br>
>><br>
>> *#### Denied Sites*<br>
>> *acl sitios_denegados dstdomain "**/usr/local/squid/etc*<br>
>> */sitiosdenegados"*<br>
>> *http_access deny sitios_denegados*<br>
>> *####*<br>
>><br>
>> *#### Block HTTPS*<br>
>> *acl blockhttps ssl::server_name
"/**usr/local/squid/etc*<br>
>> */sitiosdenegados"*<br>
>> *ssl_bump terminate blockhttps*<br>
>> *ssl_bump splice equipos_permitidos*<br>
>> *ssl_bump peek all*<br>
>> *ssl_bump splice all*<br>
>> *####*<br>
>><br>
>> *sslproxy_cert_error allow all*<br>
>> *sslproxy_flags DONT_VERIFY_PEER*<br>
>> *sslproxy_options NO_SSLv3:NO_SSLv2*<br>
>><br>
>><br>
>> Basically I'm using squid to allow everything and deniy
some users (hosts)<br>
>> and some sites (http and https).<br>
>><br>
>> If I use IE or Firefox (Win/Lin), everything works great,
if I access a<br>
>> site via HTTP the user see a message and if he access via
HTTPS the<br>
>> conecction is terminated and there is an error on the
browser.<br>
>><br>
>> But, If I access any google site using chrome (windows /
linux) the sites<br>
>> are getting bumped (google.com, google.com.X youtube.com,
etc)<br>
>><br>
>> The browser complains with a "Your conecction is not
private" and the<br>
>> certificate is my own certificate.<br>
>><br>
>> I'm missing something ?<br>
>><br>
>> I only what to splice everythng.<br>
>><br>
>> Thanks<br>
>><br>
>><br>
>> _______________________________________________<br>
>> squid-users mailing list<br>
>> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
>> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
>><br>
>><br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJWiDCiAAoJENNXIZxhPexGoQgH/3tVYeLA0ymswptTFgXCafjD
<br>
4dVdYyeqUklxAD1Z9kdTAwebKr8gCum+pSJJti474hjNpgQQlHsTc/syxMxMJGsF
<br>
Z2V0e1GCFjhDf+PBoBRIO0tJw5fhSR7RUhWT5HeZ5OuP412XtjyLH1eRJqKShh+x
<br>
VBL+7btpC5CwhDyHtM35UXCwM43tkuXo3uF8FibZn3AgxKM7EZJ0NndwK5od0kW1
<br>
PaTmUqeODXJZdXjceVF4dYeTt6GfSvzfrtXiPMIogk0w0Z2bJi5Sj/w7tr1x7VPH
<br>
ls8kccXKVCKp0kigoEMLD86DzznKd1c4r+rZguEGycQQfN8MIpzc8wQZEm61nx0=
<br>
=aiMO
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>