<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I want to start saying I'm new working with squid so <span>bear with <em>me</em></span>. We are at my company trying to use squid as egress solution for our servers running in AWS.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We need to have a whitelisting function in place.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
HTTP works fine but not HTTPS. <br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
When trying to run curl from another server using squid to access internet we receive this message:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(200, 38, 19);"> </span><span style="color: rgb(200, 38, 19);"><b>#curl https://microsoft.com</b></span><span><b><br>
</b></span>
<div><span style="color: rgb(200, 38, 19);"><b>curl: (60) SSL certificate problem: self signed certificate in certificate chain</b></span><b><br>
</b></div>
<div><span style="color: rgb(200, 38, 19);"><b>More details here: https://curl.haxx.se/docs/sslcerts.html</b></span><br>
</div>
<div><br>
</div>
<div><span style="color: rgb(200, 38, 19);"><b>curl failed to verify the legitimacy of the server and therefore could not</b></span><b><br>
</b></div>
<div><span style="color: rgb(200, 38, 19);"><b>establish a secure connection to it. To learn more about this situation and</b></span><b><br>
</b></div>
<div><span style="color: rgb(200, 38, 19);"><b>how to fix it, please visit the web page mentioned above.</b></span></div>
<div><br>
</div>
<div>When checking the squid cache log file this is showing:</div>
<div><br>
</div>
<div><b><span># tail -f /var/log/squid/cache.log<br>
</span></b>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:01 kid1| HTCP Disabled.</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:01 kid1| Squid plugin modules loaded: 0</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:01 kid1| Adaptation support is off.</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:01 kid1| Accepting HTTP Socket connections at local=[::]:3128 remote=[::] FD 23 flags=9</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:01 kid1| Accepting NAT intercepted HTTP Socket connections at local=[::]:3129 remote=[::] FD 24 flags=41</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:01 kid1| Accepting NAT intercepted SSL bumped HTTPS Socket connections at local=[::]:3130 remote=[::] FD 25 flags=41</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:02 kid1| storeLateRelease: released 0 objects</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>security_file_certgen helper database '/var/spool/squid/ssl_db' failed: Failed to open file /var/spool/squid/ssl_db/index.txt</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:10 kid1| Error negotiating SSL connection on FD 12: error:00000001:lib(0):func(0):reason(1) (1/0)</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:12 kid1| Error negotiating SSL connection on FD 12: error:00000001:lib(0):func(0):reason(1) (1/0)</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:14 kid1| Error negotiating SSL connection on FD 12: error:00000001:lib(0):func(0):reason(1) (1/0)</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:19 kid1| Error negotiating SSL connection on FD 12: error:00000001:lib(0):func(0):reason(1) (1/0)</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 100, 192);"><b>2019/11/20 08:25:19 kid1| Error negotiating SSL connection on FD 12: error:00000001:lib(0):func(0):reason(1) (1/0)</b></span><b><br>
</b></div>
<b><span style="color: rgb(12, 100, 192);">2019/11/20 08:25:20 kid1| Error negotiating SSL connection on FD 12: error:00000001:lib(0):func(0):reason(1) (1/0)</span><br>
</b></div>
<div><b><br>
</b></div>
<div>The squid.conf looks like this:</div>
<div><b><br>
</b></div>
<div><b><span style="color: rgb(12, 136, 42);">#acl localnet src 10.0.0.0/8</span><span><br>
</span></b>
<div><span style="color: rgb(12, 136, 42);"><b>visible_hostname centos-squid-4.1</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl SSL_ports port 443</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 80 # http</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 21 # ftp</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 443 # https</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 70 # gopher</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 210 # wais</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 1025-65535 # unregistered ports</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 280 # http-mgmt</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 488 # gss-http</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 591 # filemaker</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl Safe_ports port 777 # multiling http</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl CONNECT method CONNECT</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl allowed_http_sites dstdomain .microsoft.com</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl allowed_http_sites dstdomain .google.com</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl allowed_http_sites dstdomain .redhat.com</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>http_access allow allowed_http_sites Safe_ports</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>http_port 3128</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>http_port 3129 intercept</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>#SSL Settings</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl allowed_https_sites dstdomain .microsoft.com</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>http_access allow CONNECT allowed_https_sites</b></span><b><br>
</b></div>
<span style="color: rgb(12, 136, 42);"><b>options=SINGLE_DH_USE,SINGLE_ECDH_USE tls-dh=/etc/squid/dhparam.pem</b></span><b><br>
</b>
<div><span style="color: rgb(12, 136, 42);"><b>https_port 3130 intercept ssl-bump generate-host-certificates=on cert=/etc/squid/fredrik_cert/squid.pem key=/etc/squid/fredrik_cert/squid.key options=SINGLE_DH_USE,SINGLE_ECDH_USE tls-dh=/etc/squid/dhparam</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>.pem</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b># And finally deny all other access to this proxy</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>http_access deny all</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>http_access deny !Safe_ports</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>http_access deny CONNECT !SSL_ports</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b># Leave coredumps in the first cache dir</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>coredump_dir /var/spool/squid</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>#</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b># Add any of your own refresh_pattern entries above these.</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>#</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>refresh_pattern ^ftp: 1440 20% 10080</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>refresh_pattern ^gopher: 1440 0% 1440</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>#refresh_pattern .</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl step1 at_step SslBump1</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl step2 at_step SslBump2</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>acl step3 at_step SslBump3</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>ssl_bump peek step1 all</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>ssl_bump peek step2 allowed_https_sites</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>ssl_bump splice step2 allowed_https_sites</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>ssl_bump splice step3 allowed_https_sites</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>ssl_bump terminate step2 all</b></span><b><br>
</b></div>
<div><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>cache_mem 1024 MB</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 16MB</b></span><b><br>
</b></div>
<div><span style="color: rgb(12, 136, 42);"><b>sslcrtd_children 10</b></span><b><br>
</b></div>
<b><span style="color: rgb(12, 136, 42);">ssl_bump bump all</span></b></div>
<div><br>
<b><span style="color: rgb(12, 136, 42);"></span></b></div>
<div><b>Please assist me! <br>
</b></div>
<div><b>Nick</b><br>
<b><span style="color: rgb(12, 136, 42);"></span></b></div>
<div><b><span></span></b><br>
</div>
</div>
</body>
</html>