I have set up
squid3 and setup SSL bump on it. For this purpose I have generated a certificate, which appeared in 3 files:
myserver.cert myserver.csr myserver.private
If I understand correctly, this certificate is used by Squid to generate site certificates on the fly to sign them. So, I am going to add this certificate to Windows and trust it.
Unfortunately, I didn't find exact way to do this. I was happy on one machine, but can't configure on another. To add certificate, I open either Windows
certmgr.msc or Chrome's one and add certificate into all sections.
I don't know if all tools are equivalent and if there is specific correct section section to add.
How to know that?
Chrome still writes
How to know, what is wrong?
Squid SSL lines are follows:
http_port 192.168.10.25:3128 ssl-bump cert=/etc/squid/sagittarius-a.inthemoon.net.cert key=/etc/squid/sagittarius-a.inthemoon.net.private generate-host-certificates=on version=1 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE
To generate certificate file I used:
openssl genrsa -out sagittarius-a.inthemoon.net.private 2048 openssl req -new -key sagittarius-a.inthemoon.net.private -out sagittarius-a.inthemoon.net.csr ... Country Name (2 letter code) [AU]:RU State or Province Name (full name) [Some-State]:Moscow Locality Name (eg, city) :Moscow Organization Name (eg, company) [Internet Widgits Pty Ltd]:In The Moon Network Organizational Unit Name (eg, section) : Common Name (e.g. server FQDN or YOUR name) : Email Address : ... openssl x509 -req -days 3652 -in sagittarius-a.inthemoon.net.csr -signkey sagittarius-a.inthemoon.net.private -out sagittarius-a.inthemoon.net.cert
Everything is happening inside my home LAN. I am trying to browse internet via squid. Clients are Windows and Linux, squid is on Linux. Domain name is fictional.