Hold up there guys. yuri is answering a question that was not asked. On 2/03/2015 6:24 a.m., Yuri Voinov wrote: > > 01.03.15 23:18, Julianne Bielski пишет: > >> I have an https client (not a browser) that normally connects to >> a reverse proxy. When it needs to go through a forward proxy, it >> requests a CONNECT tunnel. I now have a requirement to also be >> able to encrypt the connection between my client and the forward >> proxy, and I think this is possible using Squid and the >> https_port directive (??) > Yep. > Yes. >> My question is, will my https client now have to decrypt twice? That depends on how much you trust the proxy. If you trust it fully, then you only have to encrypt the client->proxy connection. The client sends traffic inside that encrypted connection as if it were normal HTTP to a proxy. To cause the outbound connection to be encrypted the client sends URL https:// scheme. The proxy will separately encrypt the outbound connection. When the proxy is built with SSL/TLS support this works regardless of whether the client is connecting via HTTP or TLS to the proxy. If you *DONT* trust the proxy at all then use CONNECT tunnel with second layer of TLS. You also have to use DANE/TLSA to validate the server certificate using inside the CONNECT tunnel at the client end since regular trusted-CA validation does not protect agaist proxies bumping the CONNECT anyway. >> Once for the connection with the forward proxy and once for the >> connection with the reverse proxy? > > Re-encryption will performs only in case SSL-bumped connections. > *NO*. A forward proxy receiving an https:// scheme URL will always ensure outbound DIRECT connections are encrypted between the proxy and origin server. A cache_peer connection can be un-encrypted, but they must be explicitly configured by the admin. The peer will receive the https:// URL and try to encrypt its outbound under the same conditions. Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
