<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<p>Hello,</p>
<p><br>
</p>
<p>I am using Squid 5.7 on a Debian 12 system.</p>
<p><br>
</p>
<p>I would like to grant only some given URL path for a site using HTTPS.</p>
<p><br>
</p>
<p>For example, in the following configuration:</p>
<p>...</p>
<p></p>
<div>http_port 3128 ssl-bump tcpkeepalive=60,30,3 \<br>
cert=/etc/squid/certs/signingCA.crt \<br>
key=/etc/squid/certs/signingCA.key \<br>
tls-cafile=/etc/squid/certs/chain.pem \<br>
generate-host-certificates=on \<br>
dynamic_cert_mem_cache_size=20MB \<br>
cipher=HIGH:MEDIUM:!LOW:!RC4:!SEED:!IDEA:!3DES:!MD5:!EXP:!PSK:!DSS \<br>
options=NO_TLSv1,NO_SSLv3 \<br>
tls-dh=prime256v1:/etc/squid/certs/dhparam.pem</div>
<br>
<p></p>
<p><span>acl intermediate_fetching transaction_initiator certificate-fetching</span><br>
</p>
<p><span>acl SSLBumpSites ssl::server_name <a href="http://www.example.com" class="OWAAutoLink" id="LPlnk41316">
www.example.com</a><br>
</span></p>
<p>acl server src 192.168.1.1</p>
<p>acl path urlpath_regex ^/valid_path/$</p>
<p>...</p>
<p>http_access allow src path</p>
<p>...</p>
<p></p>
<div>ssl_bump peek all<br>
ssl_bump bump SSLBumpSites<br>
ssl_bump slice all<br>
<br>
http_access deny all<br>
<br>
cache deny all</div>
<div><br>
</div>
<div>Works with http (curl <a href="http://www.example.com" class="OWAAutoLink">http://www.example.com</a>/valid_path/):</div>
<div>- <span>TCP_MISS/200 467686 GET http://www.example.com/valid_path/ - HIER_DIRECT/151.101.122.132</span></div>
<div><br>
</div>
<div>Does not work with HTTPS (curl <a href="https://www.example.com/valid_path/" class="OWAAutoLink">
https://www.example.com/valid_path/</a>):<br>
</div>
<div>- TCP_DENIED/200 0 CONNECT www.example.com:443 - HIER_NONE/- - bump
<div>- NONE_NONE/403 3894 GET https://www.example.com/valid_path/ - HIER_NONE/- text/html -</div>
</div>
<br>
</div>
<div dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
Other https requests work fine:
<p>- <span>TCP_TUNNEL/200</span> - splice</p>
<p><br>
</p>
<p>What is wrong in my configuration ?</p>
<p><br>
</p>
<p>Thank you for your help.</p>
</div>
</div>
</body>
</html>