[squid-users] HTTPS proxy setup questions

[Subhish Pillai]

I was able to get https working over the http connect tunnel, but I was
still having issues with my client application connecting over the proxy.
After some research it so happens that we have implemented the HTTPS proxy
on the client side with libcurl. (implementing this - "
https://daniel.haxx.se/blog/2016/11/26/https-proxy-with-curl/").

So now my use case for the squid proxy is to be able to accept a
HTTPS_proxy request from the client and tunnel it forward to the
destination server. For that I copied over the CA bundle from the client
into the proxy server and pointed the "tls-cert" option to that file --

https_port 3128 tls-cert=/etc/squid/ssl_cert/ca-bundle.crt

I get the following error when starting the squid server --
*Dec 14 10:03:42 squid[131539]: FATAL: No valid signing certificate
configured for HTTPS_port [::]:3128*

How do I get this to work without having to create self-signed certs on the
proxy server and importing that into the client ca-bundle.

Am I missing any config steps in the squid.conf file? I think I have
misunderstood the function of the "tls-cert" and "tls-cafile" options in
the https_port line.

Thanks again for all the help!

Subhish


On Wed, Dec 12, 2018 at 6:53 PM Amos Jeffries <squid3 at treenet.co.nz> wrote:

> On 13/12/18 12:50 pm, Subhish Pillai wrote:
> > Thanks Alex, that was very helpful.
> >
> > Based on your explanation, I just want to use squid as a blind TCP
> > tunnel carrying the HTTPS connection from client to app server.
> >
> > In that case, I don't need to use ssl_bump feature and the ssl_crtd
> > program for certificate management, is that correct?
> >
>
> Going by the description you gave of the client configuration, it should
> be.
>
>
> > Would this config file work to setup the TCP tunnel --
>
> ...
> > ## Allow server side certificate errors such as untrusted certificates,
> > otherwise the connection is closed for such errors
> > sslproxy_cert_error allow all
> >
> > ## Accept certificates that fail verification (should only be needed if
> > using 'sslproxy_cert_error allow all')
> > sslproxy_flags DONT_VERIFY_PEER
> >
>
> These sslproxy_* options only apply when Squid is actively performing
> TLS to upstream servers. They have no place in the "blind tunnel"
> situation.
> (They also are deprecated in Squid-4, replaced by the
> tls_outgoing_options directive
> <http://www.squid-cache.org/Doc/config/tls_outgoing_options/>).
>
> If the client software is sending CONNECT requests containing the HTTPS
> traffic, then there is absolutely nothing your config needs to do than
> let them send those requests to the proxy (as the default config does).
>
> You do not even need Squid to be built with TLS/SSL support. That is the
> meaning of "blind" in this setup.
>
> Amos
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users
>


-- 

*Subhish Pillai*

R&D Software Quality Engineer

Broadcom | Brocade Storage Networking

T (720) 462-2900
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20181214/d10f353b/attachment.html>