<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#464646" bgcolor="#FFFFFF">
<font face="Arial">Thanks for the answer details <br>
<br>
How to be a sponsor ? ( cost ) of such feature<br>
Could you think it can be planned for 5.x ?<br>
I think it should be a "future" "standard" in the same way of DNS
over SSL <br>
</font><br>
<div class="moz-cite-prefix">Le 19/05/2020 à 16:46, Alex Rousskov a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:2cd07c05-f9da-0e14-5faf-59bc534428b5@measurement-factory.com">
<blockquote type="cite">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On 18/05/20 10:15 am, David Touzeau wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Hi we want to use squid as * * * Secure Proxy * * * using https_port
We have tested major browsers and it seems working good.
To make it work, we need to deploy the proxy certificate on all browsers
to make the secure connection running.
</pre>
</blockquote>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I hope that deployment is not necessary -- an HTTPS proxy should be
using a certificate issued for its domain name and signed by a
well-known CA already trusted by browsers. An HTTPS proxy is not faking
anything. If browsers do require CA certificate import in this
environment, it is their limitation.
On 5/19/20 9:24 AM, Matus UHLAR - fantomas wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">David, note that requiring browsers to connect to your proxy over encrypted
(https) connection, and then decrypting tunnels to real server will lower
the clients' security
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
A proper SslBump implementation for HTTPS proxy will not be "decrypting
tunnels to real server". The security of such an implementation will be
the same as of SslBump supported today (plus the additional protections
offered by securing the browser-proxy communication).
Cheers,
Alex.
_______________________________________________
squid-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a>
</pre>
</blockquote>
<br>
</body>
</html>