Hello,
this has recently started me up more then let it go. For a while chrome is upgrading in-page links to https. It is supposed to work something like https://www.bleepingcomputer.com/news/google/google-chrome-now-auto-upgrades-to-secure-connections-for-all-users/
But there is a catch for me - my squid returns something like:
(104) Connection reset by peer (TLS code:
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104)
Failed to establish a secure connection: [No Error]
or
[No Error] (TLS code:
SQUID_TLS_ERR_CONNECT+TLS_LIB_ERR=1408F10B+TLS_IO_ERR=1)
Failed to establish a secure connection: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
to the user - via error page
Log file:
1712122364.809 1172 10.0.0.1
NONE_NONE_ABORTED/000 0 CONNECT 46.255.231.158:443 - HIER_NONE/-
- SNI redir.netcentrum.cz BumpMode peek - - - ServerNegoTLS -
ServerRecTLS - ServerRecVer - ServerNegCiph - Error:
ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104
1712122366.296 23 10.0.0.1 NONE_NONE_ABORTED/000 0 CONNECT
46.255.231.158:443 - HIER_NONE/- - SNI redir.netcentrum.cz
BumpMode peek - - - ServerNegoTLS - ServerRecTLS - ServerRecVer
- ServerNegCiph - Error: ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104
1712122366.293 21 10.0.0.1 NONE_NONE_ABORTED/000 0 CONNECT
46.255.231.158:443 - HIER_NONE/- - SNI redir.netcentrum.cz
BumpMode peek - - - ServerNegoTLS - ServerRecTLS - ServerRecVer
- ServerNegCiph - Error: ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104
1712122367.111 20 10.0.0.1 NONE_NONE_ABORTED/000 0 CONNECT
46.255.231.158:443 - HIER_NONE/- - SNI redir.netcentrum.cz
BumpMode peek - - - ServerNegoTLS - ServerRecTLS - ServerRecVer
- ServerNegCiph - Error: ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104
1712122367.114 21 10.0.0.1 NONE_NONE_ABORTED/000 0 CONNECT
46.255.231.158:443 - HIER_NONE/- - SNI redir.netcentrum.cz
BumpMode peek - - - ServerNegoTLS - ServerRecTLS - ServerRecVer
- ServerNegCiph - Error: ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104
In fact - this seems to be http only sites
like -
https://www.ssllabs.com/ssltest/analyze.html?d=www.jarovnet.org
or
https://www.ssllabs.com/ssltest/analyze.html?d=redir.netcentrum.cz&s=46.255.231.158&latest.
See this snapshot from centrum web mail page source code "Více
informací o tomto zapezpečení naleznete v <a
href="" class="moz-txt-link-rfc2396E" href="http://napoveda.centrum.cz/index.php?/Knowledgebase/Article/View/18/1/">"http://napoveda.centrum.cz/index.php?/Knowledgebase/Article/View/18/1/"
"
So - what is supposed to be happening is chrome should fallback to http if there is a problem with https - i think the most obvious reason to fall back would be no output at all. So I think my effort should target the situation when squid says ERR_SECURE_CONNECT_FAIL | SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104 and to remain silent to the client.
Is there a way to do it - ie. do not show error page for not able to connect to server at all? I'd like every other problems (ie. bad/selfsigned/not matched certificate etc.) pushed to the client's eyes. I have implemented https://www.squid-cache.org/Doc/config/on_unsupported_protocol/ like in the example - but it is for an accepted TCP connections. I'd like to handle SSL errors - such as not being able to connect at all. - could it be done with https://www.squid-cache.org/Doc/config/sslproxy_cert_error/?
LL
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx https://lists.squid-cache.org/listinfo/squid-users
