Hello, We are trying to configure Squid with SSL bump in order to filter traffic with a content filter. We have an existing self-signed root certificate and private key that we use successfully with other similar proxy software, and we wish to re-use it with Squid so that we don't have to distribute a new root certificate to our clients. However, when we try to use our existing root with Squid, we get SSL errors from the browser and we are quite stumped as to why they are happening. We have provided the certificate and private key to Squid and it is successfully decrypting and re-encrypting the traffic after sending it through our filter. The message we get from Firefox is as follows: "www.google.com uses an invalid security certificate. The certificate is not trusted because no issuer chain was provided. (Error code: sec_error_unknown_issuer)" Chrome says: "NET::ERR_CERT_AUTHORITY_INVALID" Please note that this happens with any SSL site, not just Google. If we go and view the certificate that the browser sees, it appears to be valid and it shows the issuer as our custom root certificate, as expected. As I mentioned previously, this root is already installed into Firefox (and into the windows trusted root store as well). Internet Explorer and Google Chrome give similar errors. I have used openssl to verify that the modulus on the key and the certificate match (they do). Oddly, we can generate a new certificate and it will work correctly as expected, although that would require us to distribute a new root. Does anyone have any idea why our existing root will not work, but a new one will? Does Squid require certain extensions or other things that our existing certificate might not have? -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/Existing-root-certificate-not-working-with-SSL-Bump-squid-3-3-10-tp4668515.html Sent from the Squid - Users mailing list archive at Nabble.com. _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
