On 3/12/19 3:46 am, Vieri Di Paola wrote: > Hi, > > I configured a reverse proxy with something like this: > > https_port 10.215.145.81:50443 accel cert=/etc/ssl/whatever.cer > key=/etc/ssl/whatever_key_nopassphrase.pem > options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,CIPHER_SERVER_PREFERENCE,No_Compression > cipher=ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA25 > 6:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4 > tls-dh=/etc/ssl/whatever/dh2048.pem defaultsite=whatever.org NP: you have not configured any Elliptic Curve to be used, so all those EC ciphers will not be usable. Also you configured some DES based ciphers and then disable DES. > > cache_peer 10.215.248.40 parent 8080 0 no-query originserver > login=PASS front-end-https=on name=httpsServer > > [etc] > > I can load the web portal just fine from a web client connecting to > 10.215.145.81:50443. However, the web server then sends an HTTP > redirection to an HTTP URL which is something like > http://10.215.248.40:8080/whatever (in other words, the page is hosted > on the same server). That breaks the browsing experience (connection > reset). > > If I can't modify the server code at 10.215.248.40, is there a > workaround for this? You do not need to modify code anywhere. The problem is that the client is talking to port 50443 and the service is expecting port 8080 in URLs. The best solution is to have the server and Squid using the same port number. Preferably 443 for HTTPS services. Alternatively you might be able to use the vport= option on https_port to set the URL port to 8080. However, this affects *all* inbound traffic at that port and any embedded URLs the service sends the client will remain broken (contain port 8080). Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
