Thanks for your reply. Yes. I agree about the customers privacy and we should not decrypt. My users are not even using this proxy for their personal purpose and not passing any personal information and simple browse the pages to explore the wiki pages, technical information or any images like that. Just thought of enabling cache for https for few websites to just save more internet bandwidth utilization and cost saving of internet usage as most of the websites now moved from http to https. On Tue, Jan 9, 2018 at 5:42 PM, Matus UHLAR - fantomas <uhlar@xxxxxxxxxxx> wrote: > On 09.01.18 17:15, Sekar Duraisamy wrote: >> >> "To cache encryption protected content you must first remove the >> encryption. That destroys the "anonymous" part completely." >> >> Could you please provide little more details about affecting anonymous >> service. Do you meant it will affect customers anonymous or from proxy >> server? > > > I believe you have been answered already multiple times, but once more: > > the customer will have no privacy against proxy server - the proxy server > will see everything they access, all the content etc. > > This is impossible with SSL - SSL has been created just to provide privacy > to users, so nobody sees the content, only the final server. > > With HTTPS decrypting the destination server will only see your proxy > accessing, no IP, browser info (if you decide to hide it) but the proxy will > see everything. Proxy admins will be able to see their passwords, their > mail, banking account information, etc. > If your users are OK with that, fine. The question is if they really want > this kind of anonymity. > >> When we use certificate in the Proxy server to decrypt the content of >> HTTPS, multiple customers will hit to the same HTTPS website in a day >> through our proxy, that website always see single certificate even >> though multiple customers from multiple IPs. Is there a chance from >> website can block >> because of they will see more requests from more IP's but single >> certificate for the all the requests to the same doamin ? > > > The end servers will not see your proxy certificate. The HTTP server > certificate is used to authentize server, not the client. > > -- > Matus UHLAR - fantomas, uhlar@xxxxxxxxxxx ; http://www.fantomas.sk/ > Warning: I wish NOT to receive e-mail advertising to this address. > Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. > The only substitute for good manners is fast reflexes. > _______________________________________________ > > squid-users mailing list > squid-users@xxxxxxxxxxxxxxxxxxxxx > http://lists.squid-cache.org/listinfo/squid-users _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
