1

I just setup Gate Sentry on a Raspberry PI 3, and it contains Squid 3 as part of it's proxy chain.

It also utilizes ssl bump and certain websites that use SSL (usually big ones, like Facebook and Youtube) don't allow the use of the certificate. While the page itself loads, it usually doesn't load images or stylesheets that reside on static CDN servers.

For instance when loading facebook I get the following errors in the browser:

Failed to load resource: The certificate for this server is invalid. You might be connecting to a server that is pretending to be "static.xx.fbcdn.net" which could put your confidential information at risk.

And in the squid logs I get the following:

XXXXXXXX.XXX   166 127.0.0.1 NONE/200 0 CONNECT scontent-yyz1-1.xx.fbcdn.net:443 - HIER_DIRECT/31.13.80.12 -

And while I know it is really just complaining that this is a man in the middle attack, which is basically what ssl bump is...I really just want to filter traffic, and make it so that I can turn certain sites on and certain sites off at certain times; but if you want to filter an tls/ssl site, this is what is required. That being said, at other times I'd like to allow people to use Facebook on my network, just not during working hours.

I also know that the certificate that I downloaded from the server and installed on the test laptop, probably isn't the best thing to use, and I even think that it's probably the source of the issue since it isn't certified by a CA.

If the certificate I decide to use, is certified by a CA, will this work? What sort of certificate do I need to install in the browser to keep it from complaining? Is the process the same if I want to do transparent proxying with this eventually?

1

GateSentry generates the certificates of the host that you are accessing on-the-fly so that your browser believes that it is accessing the original site.

That certificate has to be signed by a Certification Authority that your browser trusts otherwise you'll get error messages such as the one you've seen. GateSentry comes with a default CA certificate which you could install.

To get your browser to trust this CA certificate you'll have to add it to the browser's list of trust anchors.

How you do that depends on the browser and OS and it will have to be done on every computer that uses your network.

I believe that the default CA certificate that GateSentry uses is a self-signed one generated by ai.com. When you add a certificate to your trust-anchor list you are basically saying that you trust that organisation. Have you heard of ai.com, let alone trust them? It's your call of course, but I'd seriously consider replacing that certificate with your own self-signed certificate - after all, I'm sure you trust yourself more than anyone; especially someone you've never heard of before!

What's worse - if you decide to trust the ai.com certificate on a laptop, tablet or smartphone then in the future you may wander onto a WiFi service that also uses GateSentry and if they're using the same ai.com certificate you'll be sharing all your private information with them!


You cannot use a certificate that is signed by a commercial CA as the certificate you require will need to be a CA certificate, not an end-entity one (such as a TLS certificate). A CA certificate can sign subordinate certificates such as the TLS ones that GateSentry impersonates. The SSL/TLS certificates that you can purchase from commercial CAs cannot sign subordinate certificates therefore are of no use in this scenario. CAs don't generally issue CA certificates and definitely won't do so to individuals.

  • So there's no way around this? Unless I can get a certificate from a CA? I mean I've already gotten an SSL certificate before...is this different? – leeand00 Jun 14 '16 at 19:49
  • Something like this? jamielinux.com/docs/openssl-certificate-authority – leeand00 Jun 14 '16 at 20:05
  • Alright and then I have to install part of that on Gate Sentry...as well as on the machines that use the proxy? – leeand00 Jun 14 '16 at 20:16
  • 1
    The certificate and it's private key go on GateSentry and the certificate only on each machine that use the proxy. – garethTheRed Jun 14 '16 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.