<div dir="ltr"><span style="font-size:13px">Just one thing I noticed: </span><div><span style="font-size:13px"><br></span></div><div><span style="font-size:13px">"clientca" is not the CA which issued your "cert" (<a href="http://sklad.duckdns.org">sklad.duckdns.org</a>) - it's the CA to be used when doing client-side authentication, which I'm not sure if you're doing. </span><br></div><div><span style="font-size:13px"><br></span></div><div><span style="font-size:13px">Dio</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Aug 24, 2016 at 2:02 PM, Samuraiii <span dir="ltr"><<a href="mailto:samurai.no.dojo@gmail.com" target="_blank">samurai.no.dojo@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
> Please give more details for "fails".<br>
><br>
> Is the following your entire squid.conf (except for comments)?<br>
><br>
> Have you tried getting SSL access to Squid working before introducing<br>
> authentication?<br>
><br>
> What are you trying, to test this, and what are the results?<br>
><br>
><br>
> Regards,<br>
><br>
><br>
> Antony.<br>
</span>First I would like to apologize for previous incomplete mail.<br>
I got interrupted and accidentally sent it out before being complete.<br>
<br>
Squid fails to start for me with:<br>
FATAL: No valid signing SSL certificate configured for HTTPS_port [::]:8443<br>
I have found that this is related to missing self signed certificate,<br>
and since I do not want to use self signed certificate I am asking if I<br>
can do anything about it.<br>
I would like to avoid self signed certificates so my users would not<br>
need to import and replace my own certs.<br>
<br>
<br>
And here is my complete squid.conf:<br>
<div><div class="h5"><br>
acl SSL_ports port 443<br>
acl Safe_ports port 80 # http<br>
acl Safe_ports port 21 # ftp<br>
acl Safe_ports port 443 # https<br>
acl Safe_ports port 70 # gopher<br>
acl Safe_ports port 210 # wais<br>
acl Safe_ports port 1025-65535 # unregistered ports<br>
acl Safe_ports port 280 # http-mgmt<br>
acl Safe_ports port 488 # gss-http<br>
acl Safe_ports port 591 # filemaker<br>
acl Safe_ports port 777 # multiling http<br>
acl Safe_ports port 901 # SWAT<br>
acl CONNECT method CONNECT<br>
http_access deny !Safe_ports<br>
http_access deny CONNECT !SSL_ports<br>
http_access allow localhost manager<br>
http_access deny manager<br>
http_access deny to_localhost<br>
<br>
auth_param basic program /usr/libexec/squid/basic_pam_<wbr>auth<br>
auth_param basic children 5<br>
auth_param basic realm Proxy Authentication Required<br>
auth_param basic credentialsttl 2 hours<br>
<br>
acl authenticated proxy_auth REQUIRED<br>
http_access allow authenticated<br>
http_access deny all<br>
<br>
https_port 8443 \<br>
cert=/etc/letsencrypt/live/<a href="http://sklad.duckdns.org/cert.pem" rel="noreferrer" target="_blank">skl<wbr>ad.duckdns.org/cert.pem</a> \<br>
key=/etc/letsencrypt/live/<a href="http://sklad.duckdns.org/key.pem" rel="noreferrer" target="_blank">skla<wbr>d.duckdns.org/key.pem</a> \<br>
</div></div> clientca=/etc/letsencrypt/<wbr>live/<a href="http://sklad.duckdns.org/fullchain.pem" rel="noreferrer" target="_blank">sklad.duckdns.org/<wbr>fullchain.pem</a> \<br>
tls-dh=/etc/ssl/certs/dhparam.<wbr>pem \<br>
<span class=""> options=NO_SSLv2,NO_SSLv3,<wbr>SINGLE_DH_USE \<br>
cipher=HIGH<br>
cache_dir aufs /var/cache/squid 512 16 256<br>
coredump_dir /var/cache/squid<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
refresh_pattern . 0 20% 4320<br>
<br>
<br>
</span>One more apology for escaped mail.<br>
<span class="HOEnZb"><font color="#888888">S<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/<wbr>listinfo/squid-users</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><br>--------<br><br>Diogenes S. de Jesus</div></div></div>
</div>