Try to
specify roots CA bundle/dir explicity by specifying
one of this
params:
# TAG: sslproxy_cafile
# file containing CA certificates to use when
verifying server
# certificates while proxying
https:// URLs
#Default:
# none
# TAG: sslproxy_capath
# directory containing CA certificates to use when
verifying
# server certificates while proxying
https:// URLs
#Default:
# none
18.04.2017 18:46, Olly Lennox пишет:
> Hi All,
>
> Still having problems here. This is my https
config now:
>
>
> ---------------------------------https_port 3129
intercept ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=4MB
cert=/etc/squid3/ssl_cert/squid.crt
key=/etc/squid3/ssl_cert/squid.key options=NO_SSLv3
dhparams=/etc/squid3/ssl_cert/dhparam.pem
>
> acl step1 at_step SslBump1
> ssl_bump peek step1
> ssl_bump bump all
> sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_DH_USE
> sslproxy_cipher
EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
>
> sslcrtd_program /usr/lib/squid3/ssl_crtd -s
/var/lib/ssl_db -M 4MB
> sslcrtd_children 8 startup=1 idle=1
>
> ---------------------------------
>
>
> I'm running version 3.5.23 with openssl 1.0. I've
had to disable libecap because I couldn't build 3.5
with ecap enabled. I'm getting the following error
when trying to connect with SSL:
>
> ---------------------------------
>
> The following error was encountered while trying
to retrieve the URL:
https://www.google.co.uk/*
>
> Failed to establish a secure connection to
216.58.198.67
>
> The system returned:
>
> (71) Protocol error (TLS code:
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
> SSL Certficate error: certificate issuer (CA) not
known: /C=US/O=Equifax/OU=Equifax Secure Certificate
Authority
>
> This proxy and the remote host failed to
negotiate a mutually acceptable security settings for
handling your request. It is possible that the remote
host does not support secure connections, or the proxy
is not satisfied with the host security credentials.
>
> Your cache administrator is webmaster.
>
> Generated Tue, 18 Apr 2017 12:23:40 GMT by
raspberrypi (squid/3.5.23)
> ---------------------------------
>
> The CA is always listed as not known not matter
what site I try I always get this error.
>
> Any ideas?
>
> Thanks,
>
> Olly
>
> ________________________________
> From: Olly Lennox <
oliver@xxxxxxxxxxxx>
> To: Amos Jeffries <
squid3@xxxxxxxxxxxxx>;
"
squid-users@xxxxxxxxxxxxxxxxxxxxx"
<
squid-users@xxxxxxxxxxxxxxxxxxxxx>
> Sent: Sunday, 16 April 2017, 9:31
> Subject: Re: HTTPS woes
>
>
>
> Thanks Amos, it's finally built but I had to
disabled ecap, for whatever reason this kept failing
(with version 1.0.1 installed). It failed on a
reference to the Area function I think but I don't
have the error message copied. I'm trying now to
configure the ssl stare/peek and will let you know how
it goes.
>
> Olly
>
>
oliver@xxxxxxxxxxxx
> lennox-it.uk
> tel: 07900 648 252
>
>
>
> ________________________________
> From: Amos Jeffries <
squid3@xxxxxxxxxxxxx>
> To:
squid-users@xxxxxxxxxxxxxxxxxxxxx
> Sent: Saturday, 15 April 2017, 23:07
> Subject: Re: HTTPS woes
>
>
>
> On 15/04/2017 9:59 a.m., Olly Lennox wrote:
>> Hi Guys.
>> I'm still struggling with this. I'm trying to
build a version of 3.5 but I just can't get it to
work. I'm currently attempting to rebuild the stretch
package with SSL enabled but build keeps failing with
the following:
>> ../../src/ssl/gadgets.h:83:45: error:
âCRYPTO_LOCK_X509â was not declared in this scope
typedef LockingPointer<X509, X509_free_cpp,
CRYPTO_LOCK_X509> X509_Pointer;
^~~~~~~~~~~~~~~~../../src/ssl/gadgets.h:83:61: error:
template argument 3 is invalid typedef
LockingPointer<X509, X509_free_cpp,
CRYPTO_LOCK_X509> X509_Pointer;
^../../src/ssl/gadgets.h:89:53: error:
âCRYPTO_LOCK_EVP_PKEYâ was not declared in this scope
typedef LockingPointer<EVP_PKEY, EVP_PKEY_free_cpp,
CRYPTO_LOCK_EVP_PKEY> EVP_PKEY_Pointer;
^~~~~~~~~~~~~~~~~~~~../../src/ssl/gadgets.h:89:73:
error: template argument 3 is invalid typedef
LockingPointer<EVP_PKEY, EVP_PKEY_free_cpp,
CRYPTO_LOCK_EVP_PKEY> EVP_PKEY_Pointer;
^../../src/ssl/gadgets.h:116:43: error:
âCRYPTO_LOCK_SSLâ was not declared in this scope
typedef LockingPointer<SSL, SSL_free_cpp,
CRYPTO_LOCK_SSL> SSL_Pointer;
^~~~~~~~~~~~~~~../../src/ssl/gadgets.h:116:58: error:
template argument 3 is invalid typedef
LockingPointer<SSL, SSL_free_cpp,
CRYPTO_LOCK_SSL> SSL_Pointer;
^
>> Any ideas?
>
>
> On Jesse/stable:
>
> apt-get build-dep squid3
> apt-get install libss-dev
>
>
> On stretch/testing/unstable:
>
> apt-get build-dep squid
> apt-get install libss1.0-dev
>
>
> That should do it for you.
>
> Amos
>
>
> _______________________________________________
> squid-users mailing list
>
squid-users@xxxxxxxxxxxxxxxxxxxxx
>
http://lists.squid-cache.org/listinfo/squid-users
>
>
>
> _______________________________________________
> squid-users mailing list
>
squid-users@xxxxxxxxxxxxxxxxxxxxx
>
http://lists.squid-cache.org/listinfo/squid-users
