-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 05.09.15 18:30, Xen пишет: > On 09/05/2015 02:22 PM, Rafael Akchurin wrote: >> Hello Xen, >> >> The certificate warning was most probably indeed caused by default SHA-1 signature of the mimicked certificate in stock version of Squid present by default in popular Linux distribs. Latest version does that correctly and your "not private" connection warnings in Chrome/etc is now gone. >> >> Please see http://docs.diladele.com/faq/filtering/chrome_not_private.html - I tried to explain it clearly. >> Please note this is may also be caused by your trusted root certificates expiring in 2017+. >> >> Hope other members of the list know better the cipher set. I am very interested in this too. >> >> Best regards, >> Rafael Akchurin >> Diladele B.V. > > Thank you mr. Diladele. Actually when I first ran into this I was using your packaged version of Squid on Windows. I just couldn't get it working, although I had a wrong certificate (generated in a different way on Debian) at first and I didn't notice. But after that was fixed, if I remember correclty, I still had the problems with Opera and Chrome. > > I have no clue what changed now to remove this problem. Maybe my memory is incorrect of this. > > The Diladele Squid, of course, was a version 3.5 > > But if you say the SHA1 warning created the Invalid Certificate warning (as you indicate) then perhaps I am mistaken about my Windows problems now. In any case I upgraded and now it seems to work :). > > Regards... > > >> >> -----Original Message----- >> From: squid-users [mailto:squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx] On Behalf Of Xen >> Sent: Saturday, September 5, 2015 1:58 PM >> To: squid-users@xxxxxxxxxxxxxxxxxxxxx >> Subject: Default ssl-bump that works with chrome/opera >> >> Hey, >> >> Might I perhaps ask. >> >> Currently with the default minimum configuration for ssl-bump that is advocated everywhere, my Firefox bumping works but Chrome and Opera are more strict and will say my certificate is invalid. >> >> The certificate was simply generated (self-signed) with openssl x509 with no additional options for cipher or message digest or whatever. >> Browsers typically complain that the certificate was signed using an insecure hash (sha1). I don't know if this is the result of my own certificate or whether it is the result of what Squid does to it using the regen it does. All you need just re-generate your proxy CA with right options. Look at the examples: # SHA1 signing openssl req -x509 -new -nodes -config D:\OpenSSL-Win64\bin\openssl.cfg -key rootCA.key -days 10950 -out rootCA.crt # SHA256 signing openssl req -x509 -sha256 -new -nodes -config D:\OpenSSL-Win64\bin\openssl.cfg -key rootCA.key -days 10950 -out rootCA.crt # High grade: openssl genrsa -out rootCA.key 3072 openssl req -x509 -sha512 -new -nodes -config D:\OpenSSL-Win64\bin\openssl.cfg -key rootCA.key -days 10950 -out rootCA.crt # Highest grade: openssl genrsa -out rootCA.key 4096 openssl req -x509 -sha512 -new -nodes -config D:\OpenSSL-Win64\bin\openssl.cfg -key rootCA.key -days 10950 -out rootCA.crt >> >> Actually Chromium works fine now, I don't know why that change. I had so many problems with it. >> >> In fact, I don't know what happened. Both Chromium and Opera now work. >> >> I did upgrade to 3.5.7 but I tested after. >> >> All browsers mostly complain about using obsolete cipher suites though. >> >> So that is the question I wanted to ask: Is there a default SSL configuration for Squid that will limit or reduce or do away with those obsolete cipher questions and remarks? Feel free to read Squid wiki. :) http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit#Hardening >> >> I have been trying to find configs on the web, but they go into great technical detail about those ciphers and also require you to make difficult choices you can't make until and unless you are a security expert. >> >> I believe going from RSA to ECDHE_ECDSA (or something similar) will do the trick. But I also read here about Squid supporting something only in version 4. >> >> Even typing that word makes me sick. ECDHE_ECDSA buh. >> >> Does it have to be anything more difficult :P. >> >> Is there a smallest subset SSL configuration for Squid that will simply reduce those messages and allow the level of security of the original site not to go down as much? I would think that Squid doesn't communicate with that server any different than it does with me. So the whole chain is now using something less than it did before. >> >> So that is my question: give me 3 lines of code (or configuration) that will allow this? >> >> I beg of you :p :). >> >> Regards, X. >> _______________________________________________ >> squid-users mailing list >> squid-users@xxxxxxxxxxxxxxxxxxxxx >> http://lists.squid-cache.org/listinfo/squid-users > > _______________________________________________ > squid-users mailing list > squid-users@xxxxxxxxxxxxxxxxxxxxx > http://lists.squid-cache.org/listinfo/squid-users -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJV6ueKAAoJENNXIZxhPexG3tIH/RrrcT5IMnYb3tuPqNs1PfCu Fj6tpYGbC9g/VS5Iv8DAe4xV27PcLXdG2+RLUrEM3/8OLxb0pDfDdCHLKU9ZsXZS 2TI3sjkXAVFjSJDRt1JMBGQRY/DYp6cLMNfrkyeBvPVr8psopI/haoGUBX1y0eot Bo+ULvxNAdksIiFLt6ecY9wUBDyUO/iUKztC+Mg73fsjqh28JyD55aCrKldNs2Es iXdJvypEjk7xz/aBoesi1T/xJb/P2U0Vv0oD9leDx05tlPdutK0L/O8YkTrUl7Zt 8xpj2pXwptT9w76aGNuQ3mfxFypoEJYzv5rKaC3CMC67ROF6FqFrKBnN+FtKJ5c= =wOcF -----END PGP SIGNATURE----- _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
