<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:#464646;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:#464646;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="FR" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Amos,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">For your information, sslcrtvalidator_program is also not compatible with TLS1.3.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">We have done dozen of tests and we only get TLS1.2 information with sslcrtvalidator_program.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">My « </span>question-conclusion »<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"> «
could be ridiculous but the imcompability is here a fact, sorry for that.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Instead a PHP helper we have build a C++ helper (300 lines including comments) and we can also work with TLS1.3 by using basis OpenSSL
functions, we suppose the same the Squid uses…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">PS : OpenSSL is the same we use to compile Squid 5.7.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Ye Fred<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">De :</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"> squid-users [mailto:squid-users-bounces@lists.squid-cache.org]
<b>De la part de</b> David Touzeau<br>
<b>Envoyé :</b> samedi 19 novembre 2022 19:19<br>
<b>À :</b> squid-users@lists.squid-cache.org<br>
<b>Objet :</b> [SPAM] Re: [squid-users] Squid 5: server_cert_fingerprint not working fine...<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Courier New"">Thanks Amos for this clarification,<br>
<br>
We also have the same needs and indeed, we face with the same approach.<br>
<br>
It is possible that the structure of Squid could not, in some cases, recovering this type of information.<br>
Although the concept of a proxy is neither more nor less than a big browser that surfs instead of the client browsers.<br>
<br>
The SHA1 and certificate information reception are very valuable because it ensures better detection of compromised sites (many malicious sites use the same information in their certificates).<br>
This allows detecting "nests" of malicious sites automatically.<br>
<br>
Unfortunately, there is madness in the approach to security, there is a race to strengthen the security of tunnels (produced by Google and browsers vendors).<br>
What is the advantage of encrypting wikipedia and Youtube channels?<br>
<br>
On the other hand, it is crucial to look inside these streams to detect threats.<br>
This is antinomic...<br>
<br>
So TLS 1.3 and soon the use of QUIC with UDP 80/443 will make use of a proxy useless as these features are rolled out (trust Google to motivate them)<br>
Unless the proxy manages to follow this protocol madness race...<br>
<br>
For this reason, firewall manufacturers propose the use of client software that fills the gap of protocol visibility in their gateway products or you -can see a growth of workstation protections , such EDR concept<br>
<br>
Just an ideological and non-technical approach...<br>
<br>
Regards</span><o:p></o:p></p>
<div>
<p class="MsoNormal">Le 19/11/2022 à 16:50, Amos Jeffries a écrit :<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">On 19/11/2022 2:55 am, UnveilTech - Support wrote: <br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi Amos, <br>
<br>
We have tested with a "ssl_bump bump" ("ssl_bump all" and "ssl_bump bump sslstep1"), it does not solve the problem.
<br>
According to Alex, we can also confirm it's a bug with Squid 5.x and TLS 1.3. <o:p>
</o:p></p>
</blockquote>
<p class="MsoNormal"><br>
Okay. <br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">It seems Squid is only compatible with TLS 1.2, it's not good for the future...
<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
One bug (or lack of ability) does not make the entire protocol "incompatible". It only affects people trying to do the particular buggy action.
<br>
Unfortunately for you (and others) it happens to be accessing this server cert fingerprint.
<br>
<br>
I/we have been clear from the beginning that *when used properly* TLS/SSL cannot be "bump"ed - that is true for all versions of TLS and SSL before it. In that same "bump" use-case the server does not provide *any* details, it just rejects the proxy attempted
connection. In some paranoid security environments the server can reject even for "splice" when the clientHello is passed on unchanged by the proxy. HTTPS use on the web is typically *neither* of those "proper" setups so SSL-Bump "bump" in general works and
"splice" almost always. <br>
<br>
Cheers <br>
Amos <br>
<br>
_______________________________________________ <br>
squid-users mailing list <br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a>
<o:p></o:p></p>
</blockquote>
</div>
</body>
</html>