<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It's allready the case, the server as a public IP and a valid cert.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
As Amos says, it is related to the gnutls implementation which is experimental. squid has to be built with openssl to support chain certificates.<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>De :</b> Ronan Lucio <ronanlucio@gmail.com><br>
<b>Envoyé :</b> mercredi 27 mai 2020 02:10<br>
<b>À :</b> Julien TEHERY <julien.tehery@mediactivegroup.com><br>
<b>Cc :</b> squid-users@lists.squid-cache.org <squid-users@lists.squid-cache.org><br>
<b>Objet :</b> Re: [squid-users] HTTPS_PORT AND SSL CERT</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">If your server listens on a public IP, you can use a valid certificate.<br>
<br>
On Tue, May 26, 2020 at 7:24 PM Julien TEHERY<br>
<julien.tehery@mediactivegroup.com> wrote:<br>
><br>
> Hi there,<br>
><br>
> I'm actually facing a problem with Squid 4.6-1 (Debian 10).<br>
> I'm using squid with https_port directive, using an SSL certficate ( a true one, not self signed)<br>
><br>
> Here is the simple setup:<br>
><br>
> https_port X.X.X.X:8443 tls-cert=/etc/squid/mywildcard.com.pem<br>
><br>
> The fact is that setup works for all firefox version using a proxy.pac file for HTTPS connexions to the squid server.<br>
> But for chrome this is quite different. Indeed chrome uses the system's proxy settings and i noticed that sometimes it would work and sometinles it would fail.<br>
> To make it work all the time i had to add my intermediate certificate (thawte) in the local store, so that means intermediate certificate has not been delivered by the squid server as it should.<br>
><br>
> The pem file in the above setup allreadycontains this (pem file done by concatenating private key, cert, intermediate and root CA. I also tried the following syntax:<br>
><br>
> https_port X.X.X.X:8443 cert=/etc/squid/mywildcard..com.cer key=/etc/squid/mywildcard.com.key cafile=/etc/squid/mywildcard..com-intermediaire.txt<br>
><br>
> but each time i try to see with openssl client if my intermediate is delivered, it's not<br>
> I use "openssl s_client -showcerts -connect myproxy.com:8443"<br>
><br>
> If i do the same thing on an apache server with the same certificate files i can see both certificate and intermediate. Why squid isn't able to show it, did i miss something ?<br>
><br>
><br>
> Thanks for your help<br>
> _______________________________________________<br>
> squid-users mailing list<br>
> squid-users@lists.squid-cache.org<br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</div>
</span></font></div>
</body>
</html>