Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have squid configured to bump SSL connections; however, when I configure my browser to use squid as a proxy, it doesn't actually do any SSL bumping. When I check the certificate, I can see it is still using the original and not one that I'm expecting to see.

I followed the configuration from here: http://wiki.squid-cache.org/Features/SslBump

I also see that SSL Bump is enabled on port 3128 and my transparent proxy is on 3129. Is there something else I need to do?

share|improve this question

There is a more detailed explanation about settings you need DynamicSSL

For example

always_direct allow all
ssl_bump allow all
# the following two options are unsafe and not always necessary:
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER

and the cert caching preparation.

share|improve this answer
The only one it appears I am missing is ssl_bump allow all - the others shouldn't be there for reference as – Walter White Mar 12 '14 at 13:58
since you didn't say what version you use, the docs could be deprecated. Some of the settings are now called client-first, server-first. Please take look at your squid.conf.documented. – user55518 Mar 12 '14 at 14:21
Okay, I am using client-first and it didn't appear to work. It also didn't work with allow all. I'll take a look again this evening at squid.conf.documented to see which one it should be. – Walter White Mar 13 '14 at 15:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.