<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I retried everything possible in terms of order in the pem file.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
from my workstation, if i do "openssl s_client -showcerts -connect mysquid.mycompany.com:8443" i only get one certificate/issuer, but the same command on same server but different port (apache listenning on 443), i correctly get 2 certificates/issuers:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I precise my https configuration isn't for ssl_bump purpose but only to provide secure access to the http proxy through the WAN with a valid certificate.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Do you some of you use complete certificates (including intermediate) with squid? If yes please tell me how you made it work.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I do have the latest stable squid version built with openssl support.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If squid isn't able to do that, as we do with so many other softwares, I should consider to use an haproxy server or apache reverse proxy in front of the squid to handle correctly the SSL cert.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regards,<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>De :</b> Julien TEHERY <julien.tehery@mediactivegroup.com><br>
<b>Envoyé :</b> mercredi 27 mai 2020 09:54<br>
<b>À :</b> Amos Jeffries <squid3@treenet.co.nz>; squid-users@lists.squid-cache.org <squid-users@lists.squid-cache.org><br>
<b>Objet :</b> RE: [squid-users] HTTPS_PORT AND SSL CERT</font>
<div> </div>
</div>
<div dir="ltr">
<div class="x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_PlainText">Unfortunately, i've just compiled/ and built deb packages a fresh new squid 4.11
<br>
</div>
<div class="x_PlainText">Now SSL support should be fully operational, but the certificate i still not showing the intermediate.</div>
<div class="x_PlainText"><br>
</div>
<div class="x_PlainText">I just tried https_port 8443 tls-cert=/etc/squid/wildcard.mycompany.com.pem
<br>
</div>
<div class="x_PlainText">where in the pem file i have in this precise order:</div>
<div class="x_PlainText"><br>
</div>
</span></font>
<ul>
<li><font size="2">cert key</font></li><li><font size="2">server cert</font></li><li><font size="2">intermediate cert<br>
</font></li></ul>
<font size="2"><span style="font-size:11pt">
<div class="x_PlainText"><br>
</div>
<div class="x_PlainText">openssl client shows only the cert issuer, as it should show both.</div>
<div class="x_PlainText">Did I missed something ?<br>
</div>
<div class="x_PlainText"><br>
</div>
<div class="x_PlainText">On 26/05/20 7:24 pm, Julien TEHERY wrote:<br>
> To make it work all the time i had to add my intermediate certificate<br>
> (thawte) in the local store, so that means intermediate certificate has<br>
> not been delivered by the squid server as it should.<br>
<br>
The experimental GnuTLS support in Debian package does not yet support<br>
certificate chains. That is still some ways off.<br>
<br>
For now if there is a chain with intermediate certificates you still<br>
need to use an OpenSSL build of Squid.<br>
<br>
Amos</div>
<div class="x_PlainText">_______________________________________________<br>
squid-users mailing list<br>
squid-users@lists.squid-cache.org<br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</div>
</span></font></div>
</div>
</body>
</html>