<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
<br>
<br>
24.08.2016 18:23, Antony Stone пишет:<br>
<span style="white-space: pre;">> On Wednesday 24 August 2016 at
14:18:46, Yuri Voinov wrote:<br>
><br>
>> No one CA do not issue signing CA for subject, which is
not CA itself.<br>
>><br>
>> So, op wants impossible thing.<br>
><br>
> Why would one need a signING certificate just to create an
SSL connection <br>
> between the browser and Squid?<br>
><br>
> Surely one merely needs a valid signED certificate, same as
you would put on a <br>
> web server to set up secure connections to it?<br>
><br>
> OP is not intercepting secure traffic, nor making HTTP sites
look to the browser <br>
> like HTTPS ones.</span><br>
Then I do not understand what he wants op.<br>
<span style="white-space: pre;">><br>
><br>
><br>
> Antony.<br>
><br>
>> 24.08.2016 18:15, Antony Stone пишет:<br>
>>> On Wednesday 24 August 2016 at 14:02:43, Samuraiii
wrote:<br>
>>>> Squid fails to start for me with:<br>
>>>> FATAL: No valid signing SSL certificate
configured for HTTPS_port<br>
>><br>
>> [::]:8443<br>
>><br>
>>>> I have found that this is related to missing self
signed certificate,<br>
>>>> and since I do not want to use self signed
certificate I am asking if I<br>
>>>> can do anything about it.<br>
>>>> I would like to avoid self signed certificates so
my users would not<br>
>>>> need to import and replace my own certs.<br>
>>><br>
>>> Have you tried adding the option
"generate-host-certificates=off" to your<br>
>>> https_port line?<br>
>>><br>
>>> I'm not an expert on this bit of Squid, but I'm just
looking at<br>
>>>
<a class="moz-txt-link-freetext" href="http://www.squid-cache.org/Versions/v3/3.5/cfgman/https_port.html">http://www.squid-cache.org/Versions/v3/3.5/cfgman/https_port.html</a>
and<br>
>><br>
>> noticing<br>
>><br>
>>> anything to do with a "signing certificate" (which
you do not have,<br>
>><br>
>> and do not<br>
>><br>
>>> want to use).<br>
>>><br>
>>>> And here is my complete squid.conf:<br>
>>>><br>
>>>> acl SSL_ports port 443<br>
>>>> acl Safe_ports port 80 # http<br>
>>>> acl Safe_ports port 21 # ftp<br>
>>>> acl Safe_ports port 443 # https<br>
>>>> acl Safe_ports port 70 # gopher<br>
>>>> acl Safe_ports port 210 # wais<br>
>>>> acl Safe_ports port 1025-65535 # unregistered
ports<br>
>>>> acl Safe_ports port 280 # http-mgmt<br>
>>>> acl Safe_ports port 488 # gss-http<br>
>>>> acl Safe_ports port 591 # filemaker<br>
>>>> acl Safe_ports port 777 # multiling http<br>
>>>> acl Safe_ports port 901 # SWAT<br>
>>>> acl CONNECT method CONNECT<br>
>>>> http_access deny !Safe_ports<br>
>>>> http_access deny CONNECT !SSL_ports<br>
>>>> http_access allow localhost manager<br>
>>>> http_access deny manager<br>
>>>> http_access deny to_localhost<br>
>>>><br>
>>>> auth_param basic program
/usr/libexec/squid/basic_pam_auth<br>
>>>> auth_param basic children 5<br>
>>>> auth_param basic realm Proxy Authentication
Required<br>
>>>> auth_param basic credentialsttl 2 hours<br>
>>>><br>
>>>> acl authenticated proxy_auth REQUIRED<br>
>>>> http_access allow authenticated<br>
>>>> http_access deny all<br>
>>>><br>
>>>> https_port 8443 \<br>
>>>><br>
>>>>
cert=/etc/letsencrypt/live/sklad.duckdns.org/cert.pem \<br>
>>>>
key=/etc/letsencrypt/live/sklad.duckdns.org/key.pem \<br>
>>>>
clientca=/etc/letsencrypt/live/sklad.duckdns.org/fullchain.pem \<br>
>>>> tls-dh=/etc/ssl/certs/dhparam.pem \<br>
>>>> options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE \<br>
>>>> cipher=HIGH<br>
>>>><br>
>>>> cache_dir aufs /var/cache/squid 512 16 256<br>
>>>> coredump_dir /var/cache/squid<br>
>>>> refresh_pattern ^ftp: 1440 20%
10080<br>
>>>> refresh_pattern ^gopher: 1440 0%
1440<br>
>>>> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
>>>> refresh_pattern . 0 20%
4320<br>
>>><br>
>>> Antony.<br>
></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJXvZKIAAoJENNXIZxhPexG5iIIAJTZAbpMkYDqdVWG5thlBxG0
<br>
cJBXI/MmYN7Al6GiGGD1ttqXHv6AAIeg5NXue0qVM/hGcJuE5eTI4+10zzQImeTU
<br>
OFRHz/C4EqBCDb06lfM+spR/5xFxW4l8vXYxr9Q61YYE2JyCvmMEoABntiWrE0/+
<br>
pwoUiNK2lIVURAGMBjMzMYwAC/t0D8JRg79gsh+o/h3TtOtAiKFbZRU3Dy2EqP9E
<br>
0pNssmSvUSR4Du0mY4fZJisAnUNUzYz1qkX0GyS0zdj6LZ4r7VlTX+fjyfPGd/fg
<br>
va1nQFgA5IqQ+VKoD02GSNBkNCw56j8aOwoo3RXO6bLKPell5NFzWVC3Wrn0AXY=
<br>
=9vnU
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>