<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hello Hardik and all,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Try adding
</span> <span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">.mzstatic.com to your exclusion from SSL bump as indicated on
<a href="https://docs.diladele.com/faq/squid/sslbump_exlusions/apple_app_store.html">
https://docs.diladele.com/faq/squid/sslbump_exlusions/apple_app_store.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Please note you need to adapt it to regex as we use it in ssl::server_name directive.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Rafael Akchurin<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Diladele B.V.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> squid-users [mailto:squid-users-bounces@lists.squid-cache.org]
<b>On Behalf Of </b>Hardik Dangar<br>
<b>Sent:</b> Thursday, February 9, 2017 3:44 PM<br>
<b>To:</b> Eliezer Croitoru <eliezer@ngtech.co.il>; Squid Users <squid-users@lists.squid-cache.org><br>
<b>Subject:</b> Re: [squid-users] Transparent Squid issue with Appstore in MacOS Sierra<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">hey eliezer,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">thanks for quick response i am actually using following,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">acl DiscoverSNIHost at_step SslBump1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">acl NoSSLIntercept ssl::server_name_regex -i "/etc/squid/url.nobump"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ssl_bump splice NoSSLIntercept<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ssl_bump peek DiscoverSNIHost<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ssl_bump bump all<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">contents of url.nobump file are,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">update\.microsoft\.com$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">update\.microsoft\.com\.akadns\.net$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">v10\.vortex\-win\.data\.<a href="http://microsoft.com">microsoft.com</a>$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">settings\-win\.data\.microsoft\.com$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"># The next are trusted SKYPE addresses<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">a\.config\.skype\.com$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">pipe\.skype\.com$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">w[0-9]+\.web\.whatsapp\.com$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">tty\.scaleway\.com$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">eaadhaar\.uidai\.gov\.in$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">facebook\.com$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">opera\.com$<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">itunes\.apple\.com$<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Do i need to do anything additional? or are you suggesting i remove bumping completely and just use splice feature only.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Feb 9, 2017 at 3:52 PM, Eliezer Croitoru <<a href="mailto:eliezer@ngtech.co.il" target="_blank">eliezer@ngtech.co.il</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks for sharing the details.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">But you didn</span><span style="font-size:11.0pt">’</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">t
answered if you tried slice with ssl bump.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Let me know if you have tried it.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Eliezer</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">----</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Arial",sans-serif"><a href="http://ngtech.co.il/lmgtfy/" target="_blank"><span style="color:#0563C1">Eliezer Croitoru</span></a><br>
Linux System Administrator<br>
Mobile: +972-5-28704261<br>
Email: <a href="mailto:eliezer@ngtech.co.il" target="_blank">eliezer@ngtech.co.il</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><img border="0" width="183" height="69" id="m_-4977097702364877788Picture_x0020_1" src="cid:image001.png@01D282EB.E03F0E80"></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">
<a href="mailto:hardikdangar@gmail.com" target="_blank">hardikdangar@gmail.com</a> [mailto:<a href="mailto:hardikdangar@gmail.com" target="_blank">hardikdangar@gmail.com</a>]
<b>On Behalf Of </b>Hardik Dangar<br>
<b>Sent:</b> Wednesday, February 8, 2017 10:17 PM<br>
<b>To:</b> Eliezer Croitoru <<a href="mailto:eliezer@ngtech.co.il" target="_blank">eliezer@ngtech.co.il</a>><br>
<b>Cc:</b> Squid Users <<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a>><br>
<b>Subject:</b> Re: [squid-users] Transparent Squid issue with Appstore in MacOS Sierra</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I am using following command,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">i am converting pem file into cer using openssl and then putting that file using this command into keychain.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "~/mycert.cer"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Wed, Feb 8, 2017 at 9:36 PM, Eliezer Croitoru <<a href="mailto:eliezer@ngtech.co.il" target="_blank">eliezer@ngtech.co.il</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Can you give me\us a link to instructions how you have installed the certificate on MAC OS?<br>
I know how to do it on Windows and Linux but not MAC OS.<br>
<br>
Also, have you tried using peek and splice? From your email it seems you have not tried to use these.(If you need instructions I would be happy to share what I am using for windows updates and it can be adapted to appstore).<br>
<br>
Thanks,<br>
Eliezer<br>
<br>
----<br>
<a href="http://ngtech.co.il/lmgtfy/" target="_blank">http://ngtech.co.il/lmgtfy/</a><br>
Linux System Administrator<br>
Mobile: +972-5-28704261<br>
Email: <a href="mailto:eliezer@ngtech.co.il" target="_blank">eliezer@ngtech.co.il</a><br>
<br>
<br>
From: squid-users [mailto:<a href="mailto:squid-users-bounces@lists.squid-cache.org" target="_blank">squid-users-bounces@lists.squid-cache.org</a>] On Behalf Of Hardik Dangar<br>
Sent: Tuesday, February 7, 2017 9:06 PM<br>
To: Squid Users <<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a>><br>
Subject: [squid-users] Transparent Squid issue with Appstore in MacOS Sierra<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
Hello,<br>
<br>
<br>
Here is some information about my squid version,<br>
<br>
Squid Cache: Version 3.5.23<br>
Service Name: squid<br>
configure options: '--prefix=/usr' '--localstatedir=/var/squid' '--libexecdir=/lib/squid' '--srcdir=.' '--datadir=/share/squid' '--sysconfdir=/etc/squid' '--with-default-user=proxy' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid.pid' '--with-openssl'
'--enable-ssl-crtd' '--enable-inline' '--disable-arch-native' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-follow-x-forwarded-for' '--enable-url-rewrite-helpers=fake' '--enable-ecap'<br>
<br>
<br>
We are running squid as transparent proxy and have certs installed in all systems. Until recently all our systems were ubuntu or windows. Recently we added mac os Seirra and the biggest issue we had with mac is even after installing certificates. Few apps have
problems.<br>
<br>
Our biggest problem is Itunes Store. It just doesn't work for some reason. if we check the log we get random ip's trying to connect via 443 port but it doesn't connect.<br>
Also Skype for Mac does not work. strangely this works for windows and ubuntu in our network. Again we see the same behavior.<br>
<br>
both of these apps does not work even in Iphone and Ipad.<br>
<br>
I believe someone must be able to configure transparent squid with Mac. can anyone tell me if i need to do anything extra for Mac setup.<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>