I was able to get https working over the http connect tunnel, but I was still having issues with my client application connecting over the proxy. After some research it so happens that we have implemented the HTTPS proxy on the client side with libcurl. (implementing this - "https://daniel.haxx.se/blog/2016/11/26/https-proxy-with-curl/").
So now my use case for the squid proxy is to be able to accept a HTTPS_proxy request from the client and tunnel it forward to the destination server. For that I copied over the CA bundle from the client into the proxy server and pointed the "tls-cert" option to that file --
https_port 3128 tls-cert=/etc/squid/ssl_cert/ca-bundle.crt
I get the following error when starting the squid server --
Dec 14 10:03:42 squid[131539]: FATAL: No valid signing certificate configured for HTTPS_port [::]:3128
How do I get this to work without having to create self-signed certs on the proxy server and importing that into the client ca-bundle.
Am I missing any config steps in the squid.conf file? I think I have misunderstood the function of the "tls-cert" and "tls-cafile" options in the https_port line.
Thanks again for all the help!
Subhish
On Wed, Dec 12, 2018 at 6:53 PM Amos Jeffries <squid3@xxxxxxxxxxxxx> wrote:
On 13/12/18 12:50 pm, Subhish Pillai wrote:
> Thanks Alex, that was very helpful.
>
> Based on your explanation, I just want to use squid as a blind TCP
> tunnel carrying the HTTPS connection from client to app server.
>
> In that case, I don't need to use ssl_bump feature and the ssl_crtd
> program for certificate management, is that correct?
>
Going by the description you gave of the client configuration, it should be.
> Would this config file work to setup the TCP tunnel --
...
> ## Allow server side certificate errors such as untrusted certificates,
> otherwise the connection is closed for such errors
> sslproxy_cert_error allow all
>
> ## Accept certificates that fail verification (should only be needed if
> using 'sslproxy_cert_error allow all')
> sslproxy_flags DONT_VERIFY_PEER
>
These sslproxy_* options only apply when Squid is actively performing
TLS to upstream servers. They have no place in the "blind tunnel" situation.
(They also are deprecated in Squid-4, replaced by the
tls_outgoing_options directive
<http://www.squid-cache.org/Doc/config/tls_outgoing_options/>).
If the client software is sending CONNECT requests containing the HTTPS
traffic, then there is absolutely nothing your config needs to do than
let them send those requests to the proxy (as the default config does).
You do not even need Squid to be built with TLS/SSL support. That is the
meaning of "blind" in this setup.
Amos
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
Subhish Pillai
R&D Software Quality Engineer
Broadcom | Brocade Storage Networking
T (720) 462-2900
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
