I have squid configured to bump SSL connections; however, when I configure my browser to use squid as a proxy, it doesn't actually do any SSL bumping. When I check the certificate, I can see it is still using the original and not one that I'm expecting to see.

I followed the configuration from here: http://wiki.squid-cache.org/Features/SslBump

I also see that SSL Bump is enabled on port 3128 and my transparent proxy is on 3129. Is there something else I need to do?

1 Answer 1


There is a more detailed explanation about settings you need DynamicSSL

For example

always_direct allow all
ssl_bump allow all
# the following two options are unsafe and not always necessary:
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER

and the cert caching preparation.

  • The only one it appears I am missing is ssl_bump allow all - the others shouldn't be there for reference as
    – Walter
    Mar 12, 2014 at 13:58
  • since you didn't say what version you use, the docs could be deprecated. Some of the settings are now called client-first, server-first. Please take look at your squid.conf.documented.
    – user55518
    Mar 12, 2014 at 14:21
  • Okay, I am using client-first and it didn't appear to work. It also didn't work with allow all. I'll take a look again this evening at squid.conf.documented to see which one it should be.
    – Walter
    Mar 13, 2014 at 15:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .