<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="SV" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">You can add this line in your squid.conf<o:p></o:p></span></p>
<pre><span lang="EN-GB" style="font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"> </span><span lang="EN-GB">sslproxy_cert_error allow allowed_https_sites<o:p></o:p></span></pre>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">this should fix your issue to bypass sites without a valid certificate.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Bariq<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> squid-users <squid-users-bounces@lists.squid-cache.org>
<b>On Behalf Of </b>Berger J Nicklas<br>
<b>Sent:</b> den 21 november 2019 10:16<br>
<b>To:</b> squid-users@lists.squid-cache.org<br>
<b>Subject:</b> [squid-users] yum update fails when using squid even though .redhat.com is whitelisted<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">We are using squid for both http and https whitelisting for egress. Most of the whitelisting works fine but some specific once do not work.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">We have tried this on this versions of squid 3.5(amazon linux 2), 4.1(centos7) and 4.4(centos8).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">For instance when running yum update for redhat linux in aws from a server using squid for egress it fails:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">ec2-user]# yum update -v<o:p></o:p></p>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">Failed to set locale, defaulting to C</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">Loaded plugins: AmazonID, builddep, changelog, config-manager, copr, debug, debuginfo-install, download, generate_completion_cache, needs-restarting, playground, repoclosure, repodiff, repograph, repomanage,
reposync, uploadprofile</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">DNF version: 4.0.9</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">cachedir: /var/cache/dnf</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">repo: downloading from remote: rhui-client-config-server-8</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">error: Curl error (60): Peer certificate cannot be authenticated with given CA certificates for
<a href="https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os">
https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os</a> [SSL certificate problem: self signed certificate in certificate chain] (<a href="https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os">https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os</a>).</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">Red Hat Update Infrastructure 3 Client Configuration Server 8 0.0 B/s | 0 B 00:01 </span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">Cannot download 'https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os': Cannot prepare internal mirrorlist: Curl error (60): Peer certificate cannot be
authenticated with given CA certificates for <a href="https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os">
https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os</a> [SSL certificate problem: self signed certificate in certificate chain].</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#C82613">Error: Failed to synchronize cache for repo 'rhui-client-config-server-8'</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">If I run curl against this URL:</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">ec2-user]# curl -v <a href="https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os">
https://rhui3.eu-north-1.aws.ce.redhat.com/pulp/mirror/protected/rhui-client-config/rhel/server/8/x86_64/os</a><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* Trying 13.53.105.186...</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* TCP_NODELAY set</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* Connected to rhui3.eu-north-1.aws.ce.redhat.com (13.53.105.186) port 443 (#0)</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* ALPN, offering h2</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* ALPN, offering http/1.1</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* successfully set certificate verify locations:</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* CAfile: /etc/pki/tls/certs/ca-bundle.crt</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2"> CApath: none</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* TLSv1.3 (OUT), TLS handshake, Client hello (1):</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* TLSv1.3 (IN), TLS handshake, Server hello (2):</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* TLSv1.2 (IN), TLS handshake, Certificate (11):</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* TLSv1.2 (OUT), TLS alert, unknown CA (560):</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* SSL certificate problem: self signed certificate in certificate chain</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">* Closing connection 0</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">curl: (60) SSL certificate problem: self signed certificate in certificate chain</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">More details here: <a href="https://curl.haxx.se/docs/sslcerts.html">
https://curl.haxx.se/docs/sslcerts.html</a></span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">curl failed to verify the legitimacy of the server and therefore could not</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">establish a secure connection to it. To learn more about this situation and</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#B36AE2">how to fix it, please visit the web page mentioned above.</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Curl against <a href="https://www.redhat.com">
https://www.redhat.com</a> works fine.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">ec2-user]# curl -v <a href="https://www.redhat.com">
https://www.redhat.com</a></span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Rebuilt URL to: <a href="https://www.redhat.com/">
https://www.redhat.com/</a></span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Trying 23.52.28.149...</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TCP_NODELAY set</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Connected to <a href="http://www.redhat.com">
www.redhat.com</a> (23.52.28.149) port 443 (#0)</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* ALPN, offering h2</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* ALPN, offering http/1.1</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* successfully set certificate verify locations:</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* CAfile: /etc/pki/tls/certs/ca-bundle.crt</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0"> CApath: none</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.3 (OUT), TLS handshake, Client hello (1):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.3 (IN), TLS handshake, Server hello (2):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.2 (IN), TLS handshake, Certificate (11):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.2 (IN), TLS handshake, Server key exchange (12):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.2 (IN), TLS handshake, Server finished (14):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.2 (OUT), TLS handshake, Finished (20):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* TLSv1.2 (IN), TLS handshake, Finished (20):</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* ALPN, server accepted to use h2</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Server certificate:</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* subject: businessCategory=Private Organization; jurisdictionC=US; jurisdictionST=Delaware; serialNumber=2945436; C=US; ST=North Carolina; L=Raleigh; O=Red Hat, Inc.; OU=IT; CN=www.redhat.com</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* start date: Mar 21 00:00:00 2018 GMT</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* expire date: Mar 20 12:00:00 2020 GMT</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* subjectAltName: host "<a href="http://www.redhat.com">www.redhat.com</a>" matched cert's "<a href="http://www.redhat.com">www.redhat.com</a>"</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 Extended Validation Server CA</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* SSL certificate verify ok.</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Using HTTP2, server supports multi-use</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Connection state changed (HTTP/2 confirmed)</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Using Stream ID: 1 (easy handle 0x56153e589630)</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">> GET / HTTP/2</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">> Host: <a href="http://www.redhat.com">
www.redhat.com</a></span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">> User-Agent: curl/7.61.1</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">> Accept: */*</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">> </span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">< HTTP/2 301 </span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">< server: AkamaiGHost</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">< content-length: 0</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">< location: <a href="https://www.redhat.com/en">
https://www.redhat.com/en</a></span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">< date: Thu, 21 Nov 2019 08:47:55 GMT</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">< </span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C64C0">* Connection #0 to host <a href="http://www.redhat.com">
www.redhat.com</a> left intact</span></b><b><span style="color:#B36AE2"><o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">My squid.conf looks like this:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">visible_hostname localhost</span></b><span style="color:black"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A"># Handling HTTP requests</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">http_port 3128</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">http_port 3129 intercept</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl allowed_http_sites dstdomain .microsoft.com</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl allowed_http_sites dstdomain .google.com</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl allowed_http_sites dstdomain .redhat.com</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">http_access allow allowed_http_sites</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A"># Handling HTTPS requests</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl SSL_port port 443</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">http_access allow SSL_port</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl allowed_https_sites ssl::server_name .microsoft.com</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl allowed_https_sites ssl::server_name .google.com</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl allowed_https_sites ssl::server_name .redhat.com</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">https_port 3130 intercept ssl-bump connection-auth=off generate-host-certificates=on dynamic_cert_mem_cache_size=16MB cert=/etc/squid/ssl/squid.pem key=/etc/squid/ssl/squid.key</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl step1 at_step SslBump1</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl step2 at_step SslBump2</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">acl step3 at_step SslBump3</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">ssl_bump peek step1 all</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">ssl_bump peek step2 allowed_https_sites</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">ssl_bump splice step3 allowed_https_sites</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#0C882A">ssl_bump terminate</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><b><span style="color:#0C882A">http_access deny all</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:black">I assume this is related to that there is no certificate for this subdomain or similar? Is there a way to ignore this for ".redhat.com" or get yum update to work anyway?</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">// Nick</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>