On 01/03/11 21:49, arielf wrote:
Hello, I am trying to use Squid as proxy so that traffic goes through an icap service I built and continues to intended site. I will have several clients (browsers) that are accessing several server sites. I need help configuring https correctly :( I tried testing out my configuration using a broswer from ip: 9.148.16.192 I used firefox foxyproxy plugin to direct http traffic to 9.148.26.247:3128 and https to 3129 (machine/ports where my squid is listening, checked this with netstat) I started testing two sites, one http and another https: 1. http://mydomain.com/MyCRM/index.php 2. https://9.148.26.247:8443/ - this site runs on tomcat that I configured with mykey.jks when I start I get all OK messages: 2011/03/01 08:23:40| Accepting HTTP connections at [::]:3128, FD 15. 2011/03/01 08:23:40| Accepting HTTPS connections at [::]:3129, FD 16. 2011/03/01 08:23:40| HTCP Disabled. 2011/03/01 08:23:40| Configuring Parent 9.148.16.192/3129/0 when I try site 1 (http) all seems to work fine. however when I try site 2, I get an error: 2011/03/01 08:37:54| clientNegotiateSSL: Error negotiating SSL connection on FD 12: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request (1/-1) where am I going wrong??
The wrong step is in using https_port to receive traffic from the browser. Those ports are for receiving a SSL/TLS encrypted connection. None of the popular browsers support such encryption on the link between themselves and proxies.
The browser wraps https:// inside a plain-text HTTP method called CONNECT and sends it to the Squid port. The encrypted part goes through a tunnel the CONNECT creates.
This error message about negotiating is due to https_port failing to decrypt the non-encrypted CONNECT.
In order to break into the CONNECT requests you will need the ssl-bump mode enabled on the normal http_port. Then send both HTTP and HTTPS traffic to the same proxy port via regular browser proxy settings.
Amos -- Please be using Current Stable Squid 2.7.STABLE9 or 3.1.11 Beta testers wanted for 3.2.0.5
