Thanks for the info, Alex. That's very helpful about cleaning up my ACLs. Those ACLs are a collection of ACLs that others have suggested I use, but it would be nice to make them less confusing for me.
With my limited understanding of how sslbump works, the idea for squid to play MITM is that a self-signed cert like squidCA.der is imported to a browser's root CAs. I have left a copy of the self-signed cert named squidCA.pem in the squid's cert directory which only works if squid is told to not verify the peer. When following the instructions how to generate the self-signed cert with openssl, the .pem file must be converted to a .der file for the browser to accept it. It just dawned on me that, could this be related to the fact that the squid self-signed certs are not named the same?
On Wed, Aug 3, 2016 at 3:01 PM, Alex Rousskov <rousskov@xxxxxxxxxxxxxxxxxxxxxxx> wrote:
On 08/03/2016 08:45 AM, Stanford Prescott wrote:
> ssl_bump none localhostgreen
> ssl_bump peek tls_s1_connect all
> ssl_bump splice tls_s2_client_hello tls_to_splice
> ssl_bump stare tls_s2_client_hello all
> ssl_bump bump tls_s3_server_hello all
AFAICT, the above is too complex. You can simplify it with:
ssl_bump splice localhostgreen
ssl_bump peek tls_s1_connect
ssl_bump splice tls_to_splice
ssl_bump stare all
ssl_bump bump all
and, after polishing your ACLs a little, possibly even with:
ssl_bump splice transactions_to_splice
ssl_bump peek tls_s1_connect
ssl_bump stare all
ssl_bump bump all
where transactions_to_splice is "localhostgreen or (tls_s2_client_hello
and tls_to_splice)".
As for your original question, I recommend figuring out why Squid cannot
verify the peer. For example, your setup might be missing fresh
certificates for some well-known Root CAs. I do not know a good way to
figure out why peer verification does not work, but analyzing cache.log
with high-enough debugging level should be doable, especially if you can
reproduce the problem using a single transaction:
http://wiki.squid-cache.org/SquidFaq/BugReporting#Debugging_a_single_transaction
HTH,
Alex.
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
