3

I have squid configured to bump SSL connections; however, when I configure my browser to use squid as a proxy, it doesn't actually do any SSL bumping. When I check the certificate, I can see it is still using the original and not one that I'm expecting to see.

I followed the configuration from here: http://wiki.squid-cache.org/Features/SslBump

I also see that SSL Bump is enabled on port 3128 and my transparent proxy is on 3129. Is there something else I need to do?

2

There is a more detailed explanation about settings you need DynamicSSL

For example

always_direct allow all
ssl_bump allow all
# the following two options are unsafe and not always necessary:
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER

and the cert caching preparation.

  • The only one it appears I am missing is ssl_bump allow all - the others shouldn't be there for reference as – Walter Mar 12 '14 at 13:58
  • since you didn't say what version you use, the docs could be deprecated. Some of the settings are now called client-first, server-first. Please take look at your squid.conf.documented. – user55518 Mar 12 '14 at 14:21
  • Okay, I am using client-first and it didn't appear to work. It also didn't work with allow all. I'll take a look again this evening at squid.conf.documented to see which one it should be. – Walter Mar 13 '14 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.