<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-text-html" lang="x-unicode">
<p>Hi all,</p>
<p>I'm testing squid 4.5 and facing two issues with intermediate
CA download <br>
</p>
<p>At first there is no source IP and I don't know how to allow
this kind of requests with an identification acl </p>
<div class="de2">172.23.0.9 - user2 [15/Jan/2019:16:34:51 +0100]
"CONNECT bugs.squid-cache.org:443 HTTP/1.1" 407 4442 447
TCP_DENIED:HIER_NONE "Mozilla/5.0 (Windows NT 6.1; WOW64;
rv:64.0) Gecko/20100101 Firefox/64.0" -</div>
<div class="de1">- - - [15/Jan/2019:16:34:51 +0100] "GET <a
class="moz-txt-link-freetext"
href="http://cert.int-x3.letsencrypt.org/">http://cert.int-x3.letsencrypt.org/</a>
HTTP/1.1" 407 3536 0 TCP_DENIED:HIER_NONE "-" -</div>
172.23.0.9 - user2 [15/Jan/2019:16:34:51 +0100] "CONNECT
bugs.squid-cache.org:443 HTTP/1.1" 200 0 447 NONE:HIER_DIRECT
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101
Firefox/64.0" bump
<p>As you can see the request to letsencrypt is denied because a
basic authentication is needed, how I can do a global ACL allow
requests from squid ? I tested 127.0.0.1,local addresses but
without any success <br>
</p>
<p>So for testing purpose I removed my identification rules</p>
<p>Now Squid can get the certificate<br>
</p>
<div class="de1">- - - [15/Jan/2019:16:33:43 +0100] "GET <a
class="moz-txt-link-freetext"
href="http://cert.int-x3.letsencrypt.org/">http://cert.int-x3.letsencrypt.org/</a>
HTTP/1.1" 200 9737 0 NONE:HIER_NONE "-" -</div>
<div class="de1">172.23.0.9 - - [15/Jan/2019:16:33:43 +0100]
"CONNECT bugs.squid-cache.org:443 HTTP/1.1" 200 0 447
NONE:HIER_DIRECT "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0)
Gecko/20100101 Firefox/64.0" bump<br>
</div>
<div class="de1">172.23.0.9 - - [15/Jan/2019:16:33:43 +0100] "GET
<a class="moz-txt-link-freetext"
href="https://bugs.squid-cache.org/">https://bugs.squid-cache.org/</a>
HTTP/1.1" 503 353 349 NONE:HIER_NONE "Mozilla/5.0 (Windows NT
6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0" -</div>
<p>Cache.log<br>
</p>
<p>ssl3_get_server_certificate:certificate verify failed (1/-1/0)<br>
</p>
<p>I'm missing something?<br>
</p>
<p>Thanks</p>
<p>FredB<br>
</p>
<p> </p>
<p><br>
</p>
</div>
</body>
</html>