<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#464646" bgcolor="#FFFFFF">
<br>
Thanks alex, made this one on squid 4.10<br>
<br>
<font face="Arial"><br>
acl TestFinger </font><font face="Arial"><font face="Arial">server_cert_fingerprint
77:F6:8D:C1:0A:DF:94:8B:43:1F:8E:0E:91:5E:0C:32:42:8B:99:C9<br>
</font></font><font face="Arial"><font face="Arial"><font
face="Arial">acl ssl_step1 at_step SslBump1<br>
acl ssl_step2 at_step SslBump2<br>
acl ssl_step3 at_step SslBump3<br>
ssl_bump peek ssl_step2<br>
ssl_bump splice </font></font></font><font face="Arial"><font
face="Arial"><font face="Arial"><font face="Arial"><font
face="Arial"><font face="Arial"> ssl_step3 </font></font></font>TestFinger<br>
ssl_bump stare ssl_step2 all<br>
ssl_bump bump all<br>
<br>
But no luck, website still decrypted.<br>
<br>
<br>
</font></font></font><br>
<br>
<div class="moz-cite-prefix">Le 13/05/2020 à 21:33, Alex Rousskov a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:45902ecb-f05f-9189-a3a2-caa8fd9dd19b@measurement-factory.com">
<pre class="moz-quote-pre" wrap="">On 5/12/20 7:42 AM, David Touzeau wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">ssl_bump peek ssl_step1
ssl_bump splice TestFinger
ssl_bump stare ssl_step2 all
ssl_bump bump all
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Seems TestFinger Acls did not matches in any case
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
You are trying to use step3 information (i.e., the server certificate)
during SslBump step2: The "splice TestFinger" line is tested during
step2 and mismatches because the server certificate is still unknown
during that step. That mismatch results in Squid staring during step2.
The "splice TestFinger" line is not tested during step3 because splicing
is not possible after staring. Thus, Squid reaches "bump all" and bumps.
For a detailed description of what happens (and what information is
available) during each SslBump step, please see
<a class="moz-txt-link-freetext" href="https://wiki.squid-cache.org/Features/SslPeekAndSplice">https://wiki.squid-cache.org/Features/SslPeekAndSplice</a>
Also, if you are running v4.9 or earlier, please upgrade. We fixed one
server_cert_fingerprint bug, and that fix became a part of the v4.10
release (commit e0eca4c).
HTH,
Alex.
</pre>
</blockquote>
<br>
</body>
</html>