On 05/10/2017 11:15 PM, L A Walsh wrote: > I tried accessing a site that had an expired certificate today > In going through squid, I got [a Squid error page] > But trying the same page through IE, I got [IE error page with] > Continue to this website (not recommended). > Is there any way to put up some similar page to describe the problem, > and most importantly, allow the connection to continue at user > discretion? Yes, there is a way. Your options include: 1. Tell Squid to ignore expired certificates errors. Squid will then mimic the expired certificate while allowing the client traffic. The client should then detect the expired (fake) certificate and may offer the user to bypass the problem. However, if the client is not smart enough, it may silently allow the connection to an attacker. In general, not all clients are smart browsers (and not all users are smart enough not to bypass warnings that should not be bypassed). It is your decision who to delegate certificate freshness checks to. By default, Squid does them (and smart browsers do them as well). This is not so much about robustness but mostly about security. 2.1 Customize Squid error page(s). You can make them look almost exactly like the browser error pages if you want. 2.2. Add user-driven error bypass to #2.1. Write Squid helper scripts (at least!) that convert user clicking a link in a Squid-generated error page to Squid ignoring the expired certificate error and generating a fresh fake certificate (instead of the expired one). Implementing this well is difficult, but, AFAICT, possible. For more details and starting points, please see error_directory, sslproxy_cert_error, sslproxy_cert_adapt, and external_acl_type in squid.conf.documented. HTH, Alex. _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
