Try to specify
roots CA
bundle/dir
explicity by
specifying one
of this
params:
# TAG:
sslproxy_cafile
# file
containing CA
certificates
to use when
verifying
server
#
certificates
while proxying
https://
URLs
#Default:
# none
# TAG:
sslproxy_capath
# directory
containing CA
certificates
to use when
verifying
# server
certificates
while proxying
https://
URLs
#Default:
# none
18.04.2017
18:46, Olly
Lennox пишет:
> Hi All,
>
> Still
having
problems here.
This is my
https config
now:
>
>
>
---------------------------------https_port
3129 intercept
ssl-bump
generate-host-certificates=on
dynamic_cert_mem_cache_size=4MB cert=/etc/squid3/ssl_cert/squid.crt
key=/etc/squid3/ssl_cert/squid.key
options=NO_SSLv3 dhparams=/etc/squid3/ssl_cert/dhparam.pem
>
> acl step1
at_step
SslBump1
> ssl_bump
peek step1
> ssl_bump
bump all
>
sslproxy_options
NO_SSLv2,NO_SSLv3,SINGLE_DH_USE
>
sslproxy_cipher
EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
>
>
sslcrtd_program
/usr/lib/squid3/ssl_crtd -s /var/lib/ssl_db -M 4MB
>
sslcrtd_children
8 startup=1
idle=1
>
>
---------------------------------
>
>
> I'm
running
version 3.5.23
with openssl
1.0. I've had
to disable
libecap
because I
couldn't build
3.5 with ecap
enabled. I'm
getting the
following
error when
trying to
connect with
SSL:
>
>
---------------------------------
>
> The
following
error was
encountered
while trying
to retrieve
the URL:
https://www.google.co.uk/*
>
> Failed to
establish a
secure
connection to
216.58.198.67
>
> The
system
returned:
>
> (71)
Protocol error
(TLS code:
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
> SSL
Certficate
error:
certificate
issuer (CA)
not known:
/C=US/O=Equifax/OU=Equifax
Secure
Certificate
Authority
>
> This
proxy and the
remote host
failed to
negotiate a
mutually
acceptable
security
settings for
handling your
request. It is
possible that
the remote
host does not
support secure
connections,
or the proxy
is not
satisfied with
the host
security
credentials.
>
> Your
cache
administrator
is webmaster.
>
> Generated
Tue, 18 Apr
2017 12:23:40
GMT by
raspberrypi
(squid/3.5.23)
>
---------------------------------
>
> The CA is
always listed
as not known
not matter
what site I
try I always
get this
error.
>
> Any
ideas?
>
> Thanks,
>
> Olly
>
>
________________________________
> From:
Olly Lennox
<
oliver@xxxxxxxxxxxx>
> To: Amos
Jeffries <
squid3@xxxxxxxxxxxxx>;
"
squid-users@xxxxxxxxxxxxxxxxxxxxx"
<
squid-users@xxxxxxxxxxxxxxxxxxxxx>
> Sent:
Sunday, 16
April 2017,
9:31
> Subject:
Re:
HTTPS woes
>
>
>
> Thanks
Amos, it's
finally built
but I had to
disabled ecap,
for whatever
reason this
kept failing
(with version
1.0.1
installed). It
failed on a
reference to
the Area
function I
think but I
don't have the
error message
copied. I'm
trying now to
configure the
ssl stare/peek
and will let
you know how
it goes.
>
> Olly
>
>
oliver@xxxxxxxxxxxx
>
lennox-it.uk
> tel:
07900 648 252
>
>
>
>
________________________________
> From:
Amos Jeffries
<
squid3@xxxxxxxxxxxxx>
> To:
squid-users@xxxxxxxxxxxxxxxxxxxxx
> Sent:
Saturday, 15
April 2017,
23:07
> Subject:
Re:
HTTPS woes
>
>
>
> On
15/04/2017
9:59 a.m.,
Olly Lennox
wrote:
>> Hi
Guys.
>> I'm
still
struggling
with this. I'm
trying to
build a
version of 3.5
but I just
can't get it
to work. I'm
currently
attempting to
rebuild the
stretch
package with
SSL enabled
but build
keeps failing
with the
following:
>>
../../src/ssl/gadgets.h:83:45:
error:
âCRYPTO_LOCK_X509â
was not
declared in
this scope
typedef
LockingPointer<X509,
X509_free_cpp,
CRYPTO_LOCK_X509> X509_Pointer;
^~~~~~~~~~~~~~~~../../src/ssl/gadgets.h:83:61:
error:
template
argument 3 is
invalid
typedef
LockingPointer<X509,
X509_free_cpp,
CRYPTO_LOCK_X509> X509_Pointer;
^../../src/ssl/gadgets.h:89:53: error: âCRYPTO_LOCK_EVP_PKEYâ was not
declared in
this scope
typedef
LockingPointer<EVP_PKEY,
EVP_PKEY_free_cpp,
CRYPTO_LOCK_EVP_PKEY> EVP_PKEY_Pointer;
^~~~~~~~~~~~~~~~~~~~../../src/ssl/gadgets.h:89:73:
error:
template
argument 3 is
invalid
typedef
LockingPointer<EVP_PKEY,
EVP_PKEY_free_cpp,
CRYPTO_LOCK_EVP_PKEY> EVP_PKEY_Pointer;
^../../src/ssl/gadgets.h:116:43: error: âCRYPTO_LOCK_SSLâ was not
declared in
this scope
typedef
LockingPointer<SSL,
SSL_free_cpp,
CRYPTO_LOCK_SSL> SSL_Pointer;
^~~~~~~~~~~~~~~../../src/ssl/gadgets.h:116:58: error: template argument
3 is invalid
typedef
LockingPointer<SSL,
SSL_free_cpp,
CRYPTO_LOCK_SSL> SSL_Pointer;
^
>> Any
ideas?
>
>
> On
Jesse/stable:
>
> apt-get
build-dep
squid3
> apt-get
install
libss-dev
>
>
> On
stretch/testing/unstable:
>
> apt-get
build-dep
squid
> apt-get
install
libss1.0-dev
>
>
> That
should do it
for you.
>
> Amos
>
>
>
_______________________________________________
>
squid-users
mailing list
>
squid-users@xxxxxxxxxxxxxxxxxxxxx
>
http://lists.squid-cache.org/listinfo/squid-users
>
>
>
>
_______________________________________________
>
squid-users
mailing list
>
squid-users@xxxxxxxxxxxxxxxxxxxxx
>
http://lists.squid-cache.org/listinfo/squid-users
