<div dir="ltr">Hi all,<div><br></div><div>I'm trying to configure my Centos 7 running:</div><div>Squid Cache: Version 3.5.28<br>configure options: '--with-openssl' '--enable-ssl-crtd' --enable-ltdl-convenience<br></div><div><br></div><div>The certs/keys are legit from my company.</div><div><br></div><div>My squid.conf is very simple since it's for proof of concept</div><div><br></div><div>acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a> # RFC1918 possible internal network<br>acl localnet src <a href="http://172.16.0.0/12">172.16.0.0/12</a> # RFC1918 possible internal network<br>acl localnet src <a href="http://192.168.0.0/16">192.168.0.0/16</a> # RFC1918 possible internal network<br>acl SSL_ports port 443<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 1025-65535 # unregistered ports<br>acl Safe_ports port 280 # http-mgmt<br>acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br>acl CONNECT method CONNECT<br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br>http_access allow localhost manager<br>http_access deny manager<br>http_access allow localnet<br>http_access allow localhost<br>http_access deny all<br><br># Squid normally listens to port 3128<br>http_port <a href="http://172.16.84.242:3128">172.16.84.242:3128</a> ssl-bump \<br> cert=/etc/squid/certs/wildcardcert.pem \<br> key=/etc/squid/certs/wildcardkey.pem \<br> generate-host-certificates=on dynamic_cert_mem_cache_size=16MB<br>acl step1 at_step SSlBump1<br>ssl_bump peek step1<br>ssl_bump bump all<br>sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s /var/lib/ssl_db -M 16MB<br>sslcrtd_children 32 startup=5 idle=1<br><br></div><div>cache_dir ufs /var/spool/squid 100 16 256<br>coredump_dir /var/spool/squid<br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br><br>strip_query_terms off<br># logformat squid %>a - %un [%{%d/%b/%Y:%H:%M:%S %z}tl] "%rm %ru" %Hs %st "%{Referer}>h" "%{User-agent}>h"<br>logformat squid %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %un %Sh/%<A %mt [%>h] [%<h]<br>access_log /var/log/squid/access.log squid<br></div><div><br></div><div><br></div><div>Browsing http sites works fine, but I am having issues with https</div><div><br></div><div>In my access.log I get:</div><div>1574346211.538 30 172.16.84.241 TAG_NONE/200 0 CONNECT <a href="http://www.cnn.com:443">www.cnn.com:443</a> - HIER_DIRECT/<a href="http://www.cnn.com">www.cnn.com</a> - [User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\r\nContent-Length: 0\r\nDNT: 1\r\nProxy-Connection: Keep-Alive\r\nPragma: no-cache\r\nHost: <a href="http://www.cnn.com:443">www.cnn.com:443</a>\r\n] [-]<br></div><div><br></div><div><br></div><div>In Internet explorer I get the following:</div><div><br></div><div>Certificate Error: Navigation Blocked
<table width="730" border="0" cellspacing="0" cellpadding="0"><tbody><tr><td width="*" align="left" id="gmail-mainTitleAlign" valign="middle"><h1 id="gmail-mainTitle">There is a problem with this website’s security certificate.</h1></td></tr><tr><td><h3><div id="gmail-linkdiv" name="linkdiv"></div></h3></td></tr><tr> <td align="right" class="errorCodeAndDivider" id="errorCodeAlign"> <div class="gmail-divider"></div></td></tr> <tr><td></td><td><h3><div id="gmail-CertRevoked" style="display:none" name="CertRevoked"></div><div id="gmail-CertSigFailed" name="CertSigFailed">The security certificate presented by this website is not secure.</div><div id="gmail-CertCNMismatch" style="display:none" name="CertCNMismatch"></div><div id="gmail-CertUnknownCA" style="display:none" name="CertUnknownCA"></div><div id="gmail-CertExpired" style="display:none" name="CertExpired"></div><div id="gmail-CertWeakSignature" style="display:none" name="CertWeakSignature"></div><br><span id="gmail-securityCert2">Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.</span> </h3></td></tr> <tr><td> </td><td><h2 id="gmail-recommendation"><b>We recommend that you close this webpage and do not continue to this website.</b></h2><h2 id="gmail-recommendation"><b><br></b></h2><h2 id="gmail-recommendation"><b> </b></h2></td></tr></tbody></table></div></div>