I have set up squid3 and setup SSL bump on it. For this purpose I have generated a certificate, which appeared in 3 files:


If I understand correctly, this certificate is used by Squid to generate site certificates on the fly to sign them. So, I am going to add this certificate to Windows and trust it.

Unfortunately, I didn't find exact way to do this. I was happy on one machine, but can't configure on another. To add certificate, I open either Windows certmgr.msc or Chrome's one and add certificate into all sections.

I don't know if all tools are equivalent and if there is specific correct section section to add.

How to know that?


enter image description here

How to know, what is wrong?


Squid SSL lines are follows:

http_port ssl-bump cert=/etc/squid/sagittarius-a.inthemoon.net.cert key=/etc/squid/sagittarius-a.inthemoon.net.private generate-host-certificates=on version=1 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE

To generate certificate file I used:

openssl genrsa -out sagittarius-a.inthemoon.net.private 2048
openssl req -new -key sagittarius-a.inthemoon.net.private -out sagittarius-a.inthemoon.net.csr


Country Name (2 letter code) [AU]:RU
State or Province Name (full name) [Some-State]:Moscow
Locality Name (eg, city) []:Moscow
Organization Name (eg, company) [Internet Widgits Pty Ltd]:In The Moon Network
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:


openssl x509 -req -days 3652 -in sagittarius-a.inthemoon.net.csr -signkey sagittarius-a.inthemoon.net.private -out sagittarius-a.inthemoon.net.cert


Everything is happening inside my home LAN. I am trying to browse internet via squid. Clients are Windows and Linux, squid is on Linux. Domain name is fictional.

  • @VlastimilBurian I don't know what is my error, either it is on client (Windows or whatever) or on server (Linux) – Dims Nov 24 '16 at 9:48
  • Certificate can be trusted. If it trusted, then it SHOULD work. Also, I have it working on one of machines. – Dims Nov 24 '16 at 11:31
  • No, it is inside my LAN. domain name is fictional (although I probably own it, don't rmemeber) – Dims Nov 24 '16 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.