<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Trebuchet MS";
panose-1:2 11 6 3 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>I don’t know about Squid but I assume varnish has this feature:<o:p></o:p></p><p class=MsoNormal><a href="https://docs.varnish-software.com/varnish-cache-plus/features/backend-ssl/">https://docs.varnish-software.com/varnish-cache-plus/features/backend-ssl/</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If you just need a GW without caching it should work as expected.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Eliezer<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>----<o:p></o:p></p><p class=MsoNormal>Eliezer Croitoru<o:p></o:p></p><p class=MsoNormal>Tech Support<o:p></o:p></p><p class=MsoNormal>Mobile: +972-5-28704261<o:p></o:p></p><p class=MsoNormal>Email: <a href="mailto:ngtech1ltd@gmail.com"><span style='color:blue'>ngtech1ltd@gmail.com</span></a><o:p></o:p></p><p class=MsoNormal>Zoom: Coming soon<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> squid-users <squid-users-bounces@lists.squid-cache.org> <b>On Behalf Of </b>Sergey Maslyakov<br><b>Sent:</b> Thursday, January 14, 2021 9:41 PM<br><b>To:</b> squid-users@lists.squid-cache.org<br><b>Subject:</b> [squid-users] Mutual TLS for the upstream example<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>Folks,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>Is the CONNECT tunnel designed in a way that enables it to "enrich" the outgoing connection with mTLS authentication? "tls_outgoing_options" does not seem to work the way I was hoping it does.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>My destination server requires mTLS authentication of the client. I have a valid key-cert pair and I can successfully execute a "curl" command to fetch a document from that server using the key-cert pair at hand.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>I want to put Squid between my clients (Maven, Gradle, Docker Engine, etc) and the server so that clients would be configured to use the instance of Squid as an HTTPS proxy but would not have to be configured with the mTLS key-cert pair.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>Here is how I see it:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>Maven --- (HTTPS/CONNECT) ---> Squid (stores my mTLS key-cert pair) --- (mTLS/SSL) ---> Server<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>Is this doable within Squid architecture?<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>I got it working using NGINX with some minor hiccups and I was hoping I can do it more elegantly with Squid.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>Thank you,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Trebuchet MS",sans-serif'>/Sergey<o:p></o:p></span></p></div></div></div></body></html>