Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have squid configured to bump SSL connections; however, when I configure my browser to use squid as a proxy, it doesn't actually do any SSL bumping. When I check the certificate, I can see it is still using the original and not one that I'm expecting to see.

I followed the configuration from here: http://wiki.squid-cache.org/Features/SslBump

I also see that SSL Bump is enabled on port 3128 and my transparent proxy is on 3129. Is there something else I need to do?

share|improve this question

1 Answer 1

There is a more detailed explanation about settings you need DynamicSSL

For example

always_direct allow all
ssl_bump allow all
# the following two options are unsafe and not always necessary:
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER

and the cert caching preparation.

share|improve this answer
    
The only one it appears I am missing is ssl_bump allow all - the others shouldn't be there for reference as –  Walter White Mar 12 at 13:58
    
since you didn't say what version you use, the docs could be deprecated. Some of the settings are now called client-first, server-first. Please take look at your squid.conf.documented. –  user55518 Mar 12 at 14:21
    
Okay, I am using client-first and it didn't appear to work. It also didn't work with allow all. I'll take a look again this evening at squid.conf.documented to see which one it should be. –  Walter White Mar 13 at 15:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.