On 09/29/2016 05:44 PM, Michael Pelletier wrote: > In the squid.conf.documented, it looks like I can log the server > certificate as well as the client certificate.... > > # %ssl::<cert_subject SSL server certificate DN > # %ssl::<cert_issuer SSL server certificate issuer DN Wrong directive? The above %codes were for the external_acl_type context, not logformat IIRC. I do not know whether they are still supported in v4 but no longer documented (which would be a [documentation] bug) or not supported at all (which would be a [regression] bug). Alex. > On Thu, Sep 29, 2016 at 7:09 PM, Michael Pelletier wrote: > > I misspoke. I am getting %ssl::>sni but not %ssl::<cert_subject or > %ssl::<cert_issuer but then clients may not be sending certs out.... > > The doc says is supports server certs but using %ssl::>cert_subject > and %ssl::>cert_issuer. gives me a parse error.... > > Note the "<" instead of the ">" > > On Thu, Sep 29, 2016 at 7:01 PM, Alex Rousskov > <rousskov@xxxxxxxxxxxxxxxxxxxxxxx > <mailto:rousskov@xxxxxxxxxxxxxxxxxxxxxxx>> wrote: > > On 09/29/2016 04:50 PM, Michael Pelletier wrote: > > > I am trying to log some data during the ssl flow. > > > logformat custom ... %ssl::>sni %ssl::>cert_subject > %ssl::>cert_issuer > > > > Yet I get nothing from any of the %ssl:: entries.... > > Do your users send certificates to Squid? If not, > %ssl::>cert_subject > %ssl::>cert_issuer should be "-". These %codes are _not_ about the > origin server certificate. > > ssl::>sni is only available during certain SslBump steps. Do you use > SslBump? If yes, do you get the corresponding CONNECT entries in > your > access log (there should be more than one CONNECT per SSL connection > IIRC)? What are your ssl_bump rules? > > Alex. > > > > > *Disclaimer: *Under Florida law, e-mail addresses are public records. If > you do not want your e-mail address released in response to a public > records request, do not send electronic mail to this entity. Instead, > contact this office by phone or in writing. > _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
