<div dir="auto"><div dir="auto"></div>I worked it out, my "no Https interception" was working on websites if I put the URL in that txt file<div dir="auto"><br></div><div dir="auto">nointercept.txt</div><div dir="auto"><br></div><div dir="auto">But I needed to make a proxy.ini file as well on the host in question, for it to point to the proxy</div><div dir="auto"><br></div><div dir="auto">Once it pointed to the proxy I could then monitor the traffic and see what URL I needed to whitelist and to put in the no SSL interception</div><div dir="auto"><br></div><div dir="auto">Once I did that all good</div><div dir="auto"><br></div><div dir="auto">Thanks guys, much appreciated<br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Wed, 18 May 2022, 20:21 Eliezer Croitoru, <<a href="mailto:ngtech1ltd@gmail.com" target="_blank" rel="noreferrer">ngtech1ltd@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hey Alex,<br>
<br>
I have started working on some external_acl helper that will probe the<br>
server certificate like what ufdbguard does but will be written <br>
probably in another language then C++ ... ie scripting or GoLang or Rust.<br>
The idea is that there will be some cache or DB that will store information<br>
about an IP+port paired with SNI.<br>
A storage engine like a cache would help to "know" enough about the server<br>
to ultimately decide if there is a risk in splicing this specific<br>
connection.<br>
It's also possible that the first time that the request will pass via thru<br>
the proxy it will be bumped to probe the connection for more information<br>
when possible.<br>
<br>
In general for commercial products there is either a CDN service or a<br>
dedicated service.<br>
These usually are not the risk for the proxy users and can be spliced.<br>
The main issue is if one service on a specific IP serves more then one<br>
domain that contains different content.<br>
The best example is google CDN network that might serve on the same IP and<br>
certificate and SNI(because of HTTP/2.0) different domains.<br>
<br>
Eliezer<br>
<br>
----<br>
Eliezer Croitoru<br>
NgTech, Tech Support<br>
Mobile: +972-5-28704261<br>
Email: <a href="mailto:ngtech1ltd@gmail.com" rel="noreferrer noreferrer" target="_blank">ngtech1ltd@gmail.com</a><br>
<br>
-----Original Message-----<br>
From: squid-users <<a href="mailto:squid-users-bounces@lists.squid-cache.org" rel="noreferrer noreferrer" target="_blank">squid-users-bounces@lists.squid-cache.org</a>> On Behalf Of<br>
Alex Rousskov<br>
Sent: Wednesday, May 18, 2022 21:39<br>
To: <a href="mailto:squid-users@lists.squid-cache.org" rel="noreferrer noreferrer" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: Re: [squid-users] disable https inspection for licensing some apps<br>
<br>
On 5/18/22 12:28, robert k Wild wrote:<br>
<br>
> acl DiscoverSNIHost at_step SslBump1<br>
> acl NoSSLIntercept ssl::server_name "/usr/local/squid/etc/nointercept.txt"<br>
> ssl_bump peek DiscoverSNIHost<br>
> ssl_bump splice NoSSLIntercept<br>
> ssl_bump bump all<br>
<br>
OK, the above configuration makes the splice/bump decision based on <br>
plain text information provided by the TLS client.<br>
<br>
<br>
> and in the nointercept.txt<br>
> i have the url in there<br>
<br>
ssl::server_name needs a host/domain name, not a regular URL. No URLs <br>
are exchanged in plain text between TLS client and the origin server.<br>
<br>
Please note that, even after adjusting nointercept.txt to contain domain <br>
name(s), the above configuration may not always work in modern Squids: <br>
It will work when the client sends a matching domain name<br>
<br>
* in the CONNECT request headers (and sends no TLS SNI at all)<br>
* in the CONNECT request headers and in TLS SNI<br>
* in TLS SNI (the CONNECT request headers should not matter).<br>
<br>
It will also work when a CONNECT request is using an IP address that <br>
reverse-resolves to a matching domain name (which is not overwritten by <br>
a mismatching SNI).<br>
<br>
In all other cases, Squid will bump traffic even if it is ultimately <br>
going to the server named in nointercept.txt.<br>
<br>
There is no configuration that will address all possible cases in <br>
general. TLS makes that impossible (at least not without probing TLS <br>
origin servers which is something Squid does not do yet).<br>
<br>
<br>
HTH,<br>
<br>
Alex.<br>
<br>
<br>
>, also i have it in the url white list so it can actually see the url<br>
> <br>
> is there something else i need to add for this to work<br>
> <br>
> or maybe some websites ie license website just dont like it going through<br>
a proxy<br>
> <br>
> <br>
> On Wed, 18 May 2022 at 16:57, robert k Wild <<a href="mailto:robertkwild@gmail.com" rel="noreferrer noreferrer" target="_blank">robertkwild@gmail.com</a> <br>
> <mailto:<a href="mailto:robertkwild@gmail.com" rel="noreferrer noreferrer" target="_blank">robertkwild@gmail.com</a>>> wrote:<br>
> <br>
> hi all,<br>
> <br>
> i have squid proxy configured as ssl bump and i white list some<br>
> websites only<br>
> <br>
> but for some websites i dont want to inspect https traffic as it<br>
> breaks the cert when i want to license some apps via the url<br>
> (whitelist url)<br>
> <br>
> how can i disable https inspection for some websites please<br>
> <br>
> many thanks,<br>
> rob<br>
> <br>
> -- <br>
> Regards,<br>
> <br>
> Robert K Wild.<br>
> <br>
> <br>
> <br>
> -- <br>
> Regards,<br>
> <br>
> Robert K Wild.<br>
> <br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a href="mailto:squid-users@lists.squid-cache.org" rel="noreferrer noreferrer" target="_blank">squid-users@lists.squid-cache.org</a><br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer noreferrer noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" rel="noreferrer noreferrer" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer noreferrer noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" rel="noreferrer noreferrer" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer noreferrer noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</blockquote></div></div></div>