<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
<br>
<br>
15.01.16 23:55, lucas castro пишет:<br>
<span style="white-space: pre;">> Amos, Sorry for emailing right
to you.<br>
> ---------- Forwarded message ----------<br>
> From: lucas castro <a class="moz-txt-link-rfc2396E" href="mailto:lucascastroborges@gmail.com"><lucascastroborges@gmail.com></a><br>
> Date: Fri, Jan 15, 2016 at 2:54 PM<br>
> Subject: Re: [squid-users] Squid https bump and google apps<br>
> To: Amos Jeffries <a class="moz-txt-link-rfc2396E" href="mailto:squid3@treenet.co.nz"><squid3@treenet.co.nz></a><br>
><br>
><br>
> Amos, I'm already using squid-3.5.13 with sni,<br>
> the problem is, google use the same certificate for
youtube.com, google.com<br>
> and some others.<br>
> Or Am I doing something wrong?</span><br>
Yes. SSL Bump is _not_ main ACL tool. So, use SNI as geberal ACL is
bad idea.<br>
<br>
Right way is:<br>
<br>
- - Using bump to make FQDN visible and, next<br>
- - Using general ACL to access control _or_<br>
- - Using redirector to filter out URL's.<br>
<span style="white-space: pre;">><br>
><br>
> On Fri, Jan 15, 2016 at 2:33 PM, Amos Jeffries
<a class="moz-txt-link-rfc2396E" href="mailto:squid3@treenet.co.nz"><squid3@treenet.co.nz></a> wrote:<br>
><br>
>> On 16/01/2016 3:35 a.m., Lucas Castro wrote:<br>
>>> I've hard worked against google applications,<br>
>>> The points is, google use the same certificate for a
bunch of different<br>
>>> apps,<br>
>>> like google.com, youtube.com, drive.google.com.<br>
>>> I'd like to know if someone already got terminated
youtube.com and<br>
>>> keep working google.com and others services.<br>
>><br>
>> It is possible. Using the Squid-3.5 peek-and-splice
feature with SNI<br>
>> detection.<br>
>><br>
>> Amos<br>
>><br>
>> _______________________________________________<br>
>> squid-users mailing list<br>
>> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
>> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
>><br>
><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJWmTk0AAoJENNXIZxhPexGsXMH/34A845b1aP2K5MMt1gKBvHw
<br>
flOC1IK5jyAm8GhhCxrNwEqmYpkMhYISav/wJzwCnlXwoadNC0zD+AXvDRFF7Stb
<br>
P8EMgYG//ZWOaSVfRgv4r9Bdf8UY3ujuk35jHaIIgBrDyJKHnyLOKOaRtNC7IaOB
<br>
fdnk9dpHLae5V7OqwHSOZ8FapfYRXtbQzgG7t2EOR/0MuZg1EigOm0r5MnpKg6UG
<br>
8sEKaRAaJ5UE+9sA7KOvXBv/4KhfJNr2pJthqnLrRnM6Ye1VexyZzLU02ijRDsKC
<br>
4lkX24kHWGgj5g350vWaiN/uzChzqxxwZActwbdPi33n/vkT12TffSUPeZn2jnY=
<br>
=zavO
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>