<div dir="rtl"><div dir="ltr">By the help of God.</div><div dir="ltr"><br></div><div dir="ltr">If I'm using the self signed certificate that I created for the ssl bump, then the browser considers it as the same certificate for any domain I'm connecting to?</div></div><br><div class="gmail_quote"><div dir="rtl" class="gmail_attr">בתאריך יום ג׳, 22 בפבר׳ 2022 ב-7:35 מאת Eliezer Croitoru <<a href="mailto:ngtech1ltd@gmail.com">ngtech1ltd@gmail.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Thanks Christos,<br>
<br>
I was aware of such things but haven't seen such a case.<br>
Is there any way to "reproduce" this?<br>
I believe it should be documented in the wiki.<br>
<br>
Thanks,<br>
<br>
----<br>
Eliezer Croitoru<br>
NgTech, Tech Support<br>
Mobile: +972-5-28704261<br>
Email: <a href="mailto:ngtech1ltd@gmail.com" target="_blank">ngtech1ltd@gmail.com</a><br>
<br>
-----Original Message-----<br>
From: squid-users <<a href="mailto:squid-users-bounces@lists.squid-cache.org" target="_blank">squid-users-bounces@lists.squid-cache.org</a>> On Behalf Of Christos Tsantilas<br>
Sent: Monday, February 21, 2022 11:41<br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: Re: [squid-users] Splice certain SNIs which served by the same IP<br>
<br>
Hi Ben,<br>
<br>
When HTTP/2 is used, requests for two different domains may served using <br>
the same TLS connection if both domains are served from the same remote <br>
server and use the same TLS certificate.<br>
There is a description here:<br>
<a href="https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/" rel="noreferrer" target="_blank">https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/</a><br>
<br>
And a similar problem report here:<br>
<a href="https://bugs.chromium.org/p/chromium/issues/detail?id=1176673" rel="noreferrer" target="_blank">https://bugs.chromium.org/p/chromium/issues/detail?id=1176673</a><br>
<br>
Regards,<br>
Christos<br>
<br>
<br>
On 14/2/22 3:49 μ.μ., Ben Goz wrote:<br>
> By the help of God.<br>
> <br>
> Hi,<br>
> Ny squid version is 4.15, using it on tproxy configuration.<br>
> <br>
> I'm using ssl bump to intercept https connection, but I want to splice <br>
> several domains.<br>
> I have a problem that when I'm splicing some google domains eg. <br>
> <a href="http://youtube.com" rel="noreferrer" target="_blank">youtube.com</a> <<a href="http://youtube.com" rel="noreferrer" target="_blank">http://youtube.com</a>> then<br>
> <a href="http://gmail.com" rel="noreferrer" target="_blank">gmail.com</a> <<a href="http://gmail.com" rel="noreferrer" target="_blank">http://gmail.com</a>> domain also spliced.<br>
> <br>
> I know that it is very common for google servers to host multiple <br>
> domains on single server.<br>
> And I suspect that when I'm splicing for example <a href="http://youtube.com" rel="noreferrer" target="_blank">youtube.com</a> <br>
> <<a href="http://youtube.com" rel="noreferrer" target="_blank">http://youtube.com</a>> it'll also splices <a href="http://google.com" rel="noreferrer" target="_blank">google.com</a> <<a href="http://google.com" rel="noreferrer" target="_blank">http://google.com</a>>.<br>
> <br>
> Here are my squid configurations for the ssl bump:<br>
> <br>
> https_port xxxx ssl-bump tproxy generate-host-certificates=on <br>
> options=ALL dynamic_cert_mem_cache_size=4MB <br>
> cert=/usr/local/squid/etc/ssl_cert/myCA.pem <br>
> dhparams=/usr/local/squid/etc/dhparam.pem sslflags=NO_DEFAULT_CA<br>
> <br>
> acl DiscoverSNIHost at_step SslBump1<br>
> <br>
> acl NoSSLIntercept ssl::server_name "/usr/local/squid/etc/url-no-bump"<br>
> acl NoSSLInterceptRegexp ssl::server_name_regex -i <br>
> "/usr/local/squid/etc/url-no-bump-regexp"<br>
> ssl_bump splice NoSSLInterceptRegexp_always<br>
> ssl_bump splice NoSSLIntercept<br>
> ssl_bump splice NoSSLInterceptRegexp<br>
> ssl_bump peek DiscoverSNIHost<br>
> ssl_bump bump all<br>
> <br>
> <br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</blockquote></div>