<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi List,</p>
<p>I've just set up a new SSL interception proxy using
peek/splice/bump using squid 4.0.22 and I'm getting SSL errors on
some site indicating missing intermediate certs as described here:</p>
<p><a class="moz-txt-link-freetext" href="https://blog.diladele.com/2015/04/21/fixing-x509_v_err_unable_to_get_issuer_cert_locally-on-ssl-bumping-squid/">https://blog.diladele.com/2015/04/21/fixing-x509_v_err_unable_to_get_issuer_cert_locally-on-ssl-bumping-squid/</a><br>
</p>
<p>I have read the wiki and I see this on the SslBumpExplicit page:<br>
</p>
<p><a href="https://wiki.squid-cache.org/Squid-4">"Squid-4</a> is
capable of downloading missing intermediate CA certificates, like
popular browsers do."</p>
<p>However I'm finding that I have to follow the procedure in the
diladele article and manually install the intermediate certs into
the PKI trust to work around this.</p>
<p>My interception config is like this:</p>
<p>ssl_bump splice localhost<br>
ssl_bump peek step1 all<br>
ssl_bump splice nobumpdoms<br>
ssl_bump stare step2 all<br>
ssl_bump bump all</p>
<p>nobumpdoms is an acl pointing to a file listing domains that
should not be subject to interception, and works fine.</p>
<p>Is there something else I have to specify to get squid4 to behave
as described on the wiki?<br>
</p>
<p>Many thanks,</p>
<p>Alex<br>
</p>
<br><pre>
--
This message is intended only for the addressee and may contain
confidential information. Unless you are that person, you may not
disclose its contents or use it in any way and are requested to delete
the message along with any attachments and notify us immediately.
This email is not intended to, nor should it be taken to, constitute advice.
The information provided is correct to our knowledge & belief and must not
be used as a substitute for obtaining tax, regulatory, investment, legal or
any other appropriate advice.
"Transact" is operated by Integrated Financial Arrangements Ltd.
29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608 5300.
(Registered office: as above; Registered in England and Wales under
number: 3727592). Authorised and regulated by the Financial Conduct
Authority (entered on the Financial Services Register; no. 190856).
</pre><br>
</body>
</html>