On 09/29/2016 05:09 PM, Michael Pelletier wrote:
> The doc says is supports server certs
Which doc? I am reading squid.conf.documented in trunk/v4:
> ssl::>cert_subject
> The Subject field of the received client
> SSL certificate or a dash ('-')...
>
> ssl::>cert_issuer
> The Issuer field of the received client
> SSL certificate or a dash ('-')...
which seems to refer to client certificates, as it should.
Alex.
>
> On Thu, Sep 29, 2016 at 7:01 PM, Alex Rousskov
> <rousskov@xxxxxxxxxxxxxxxxxxxxxxx
> <mailto:rousskov@xxxxxxxxxxxxxxxxxxxxxxx>> wrote:
>
> On 09/29/2016 04:50 PM, Michael Pelletier wrote:
>
> > I am trying to log some data during the ssl flow.
>
> > logformat custom ... %ssl::>sni %ssl::>cert_subject %ssl::>cert_issuer
> >
> > Yet I get nothing from any of the %ssl:: entries....
>
> Do your users send certificates to Squid? If not, %ssl::>cert_subject
> %ssl::>cert_issuer should be "-". These %codes are _not_ about the
> origin server certificate.
>
> ssl::>sni is only available during certain SslBump steps. Do you use
> SslBump? If yes, do you get the corresponding CONNECT entries in your
> access log (there should be more than one CONNECT per SSL connection
> IIRC)? What are your ssl_bump rules?
>
> Alex.
>
>
>
> *Disclaimer: *Under Florida law, e-mail addresses are public records. If
> you do not want your e-mail address released in response to a public
> records request, do not send electronic mail to this entity. Instead,
> contact this office by phone or in writing.
>
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
