[squid-users] squid 4.1 transparent https issue "curl: (60) SSL certificate problem: self signed certificate in certificate chain"

[Alex Rousskov]

On 11/20/19 3:31 AM, Berger J Nicklas wrote:

> squid 4.1

Start by upgrading to the latest Squid v4 available.


> curl: (60) SSL certificate problem: self signed certificate in
> certificate chain

What was Squid trying to tell curl? Was Squid sending an error response?
Tell curl to run --insecure to find out what happened.


> security_file_certgen helper database '/var/spool/squid/ssl_db' failed:
> Failed to open file /var/spool/squid/ssl_db/index.txt

You should fix this. Perhaps you did not initialize the database (see
"man security_file_certgen")? Or perhaps the permissions are wrong
(checks them using something like "ls -Rla /var/spool/squid/ssl_db")?

> acl allowed_http_sites dstdomain .microsoft.com
> acl allowed_http_sites dstdomain .google.com
> acl allowed_http_sites dstdomain .redhat.com

> http_access allow allowed_http_sites Safe_ports

This allows CONNECT to port 80, which is probably not what you want. See
squid.conf.default for the recommended layout of https_access rules.


> #SSL Settings
> acl allowed_https_sites dstdomain .microsoft.com

Do not add one site twice.


> http_access allow CONNECT allowed_https_sites

This allows CONNECT to any port of the allowed_https_sites. See
squid.conf.default for the recommended layout of https_access rules.


> options=SINGLE_DH_USE,SINGLE_ECDH_USE tls-dh=/etc/squid/dhparam.pem

A copy-paste typo? There is no "options=..." directive.


> http_access deny all
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports

The last two lines are unreachable. You probably want to review how
http_access (and most other) ACL-driven directives work, including the
"first match ends the search" rule.

> ssl_bump peek step1 all
> ssl_bump peek step2 allowed_https_sites
> ssl_bump splice step2 allowed_https_sites
> ssl_bump splice step3 allowed_https_sites
> ssl_bump terminate step2 all
> ssl_bump bump all

To learn how ssl_bump rules work, please see
https://wiki.squid-cache.org/Features/SslPeekAndSplice

AFAICT, the above rules are equivalent to:

  ssl_bump peek step1
  ssl_bump peek step2 allowed_https_sites
  ssl_bump terminate step2
  ssl_bump splice all

or, roughly speaking, "splice allowed_https_sites (after peeking at
their server) and terminate everything else (ASAP)"

... which is rather different from what the original rules may have
tried to accomplish (whatever that was).


HTH,

Alex.