On 19/01/2017 3:29 a.m., Sameh Onaissi wrote: > Hello Eliezer, all > > Sorry for the late reply. > > When I configure the browser to access a non intercept port, the errors do not show up and the site is accessed without a problem. > > The client machine has the .crt file installed, but still shows the error. > > Other pages with errors: > http://pasteboard.co/nA20FD7om.png > http://pasteboard.co/nA2yWRyTE.png > > Here is the second page in a browser without an intercepted port: > http://pasteboard.co/nA39CEFGU.png > > > Thanks in advance. > Some of these sites are used to pay company bills, so it’s important to get this issue resolves ASAP. I assume from that first part that the most important of these sites are a small enough set to deal with as a special case without becoming a maintenance nightmare. The error messages both show that Squid at least cannot find one of the CA required to verify the servers cert. Soo... you can probably use the openssl client tool to identify and fetch the certs manually; then 1a) add the root CA (only if needed) into your machines global CA set, 1b) add any intermediary certs to the file Squid loads through sslproxy_foreign_intermediate_certs directive. <http://www.squid-cache.org/Doc/config/sslproxy_foreign_intermediate_certs/> OR 2) create a cache_peer to the domains server port 443, using the originserver option and sslcafile= option to specify what its CA chain is supposed to be. <http://www.squid-cache.org/Doc/config/cache_peer/> > Worth mentioning that this was not a problem about 10 days ago. Nod, these types of things can appear out of nowhere as servers certs expire or get blacklisted, ciphers etc suddenly get rejected by browsers as insecure. TLS advocates deny it, but F*ups happen far too often in reality when dealing with certs. > > > * Try the latest Squid-4, which can auto-download intermediate certificates. > > Is squid-4 stable for production? > Sorry I missed this in your earlier post. Well strictly speaking no. It still has a handful of critical bugs to be tracked down and quashed. But whether those affect you, or if they do whether its worth an occasional crash to avoid these SSL isues is a different matter. Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
