I've got a network without direct internet access where I have Squid 3.5.9 as a transparent proxy listening on tcp/8080 for HTTP and on tcp/8443 for HTTPS (redirected via iptables from tcp/80 and tcp/443 respectively).

This Squid doesn't have a direct Internet access either but can talk to a parent Squid in other part of the network that does have Internet access.

With HTTP it works well - client makes a request to http://www.example.com (port 80), router and iptables redirect the connection to Squid's port 8080, that intercepts the request and makes a request to the upstream proxy that serves it as usual. Here are the config options used:

http_port 8080 intercept
cache_peer proxy-upstream parent 3128 0 no-query
never_direct allow all

That works well. Now I wanted to do a similar thing for HTTPS:

https_port 8443 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/myCA.pem
sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB
sslcrtd_children 5

ssl_bump bump all

Without cache_peer it works as expected, i.e. auto-generates a fake SSL cert and makes a direct connection to the target.

However with cache_peer it doesn't work. I get HTTP/503 error from the proxy:

1446684476.877  0 proxy-client TAG_NONE/200 0 CONNECT - HIER_NONE/- -
1446684476.970  3 proxy-client TCP_MISS/503 4309 GET https://secure.example.com/ - FIRSTUP_PARENT/proxy-upstream text/html

Alternatively if I change the ssl_bump setup to this:

acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all

I get a crash message in cache.log:

2015/11/05 01:07:11 kid1| assertion failed: PeerConnector.cc:116: "peer->use_ssl"

When I use this proxy in non-transparent mode, i.e. configuring the proxy on client to proxy-test:3128, it works:

1446684724.879 141 proxy-client TCP_TUNNEL/200 1886 CONNECT secure.example.com:443 - FIRSTUP_PARENT/proxy--upstream -

So I need to somehow turn the HTTPS request that lands on proxy-test into CONNECT request that's forwarded to proxy-upstream. If Squid can't do that is there any other transparent-to-nontransparent proxy software that can do that?


  • I think you need sslproxy_cert_error allow all and sslproxy_flags DONT_VERIFY_PEER. BTW if it is at all possible having the clients configured to use the proxy is always better than transparent proxying - maybe redirect transproxied https (and maybe http too) requests to a page that gives instructions on how to setup the proxy for several common browsers. – cas Nov 5 '15 at 4:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.