0

I have set up squid3 and setup SSL bump on it. For this purpose I have generated a certificate, which appeared in 3 files:

myserver.cert
myserver.csr
myserver.private

If I understand correctly, this certificate is used by Squid to generate site certificates on the fly to sign them. So, I am going to add this certificate to Windows and trust it.

Unfortunately, I didn't find exact way to do this. I was happy on one machine, but can't configure on another. To add certificate, I open either Windows certmgr.msc or Chrome's one and add certificate into all sections.

I don't know if all tools are equivalent and if there is specific correct section section to add.

How to know that?

Chrome still writes ERR_CERT_AUTHORITY_INVALID:

enter image description here

How to know, what is wrong?

UPDATE

Squid SSL lines are follows:

http_port 192.168.10.25:3128 ssl-bump cert=/etc/squid/sagittarius-a.inthemoon.net.cert key=/etc/squid/sagittarius-a.inthemoon.net.private generate-host-certificates=on version=1 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE

To generate certificate file I used:

openssl genrsa -out sagittarius-a.inthemoon.net.private 2048
openssl req -new -key sagittarius-a.inthemoon.net.private -out sagittarius-a.inthemoon.net.csr

...

Country Name (2 letter code) [AU]:RU
State or Province Name (full name) [Some-State]:Moscow
Locality Name (eg, city) []:Moscow
Organization Name (eg, company) [Internet Widgits Pty Ltd]:In The Moon Network
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

...

openssl x509 -req -days 3652 -in sagittarius-a.inthemoon.net.csr -signkey sagittarius-a.inthemoon.net.private -out sagittarius-a.inthemoon.net.cert

UPDATE 2

Everything is happening inside my home LAN. I am trying to browse internet via squid. Clients are Windows and Linux, squid is on Linux. Domain name is fictional.

  • @VlastimilBurian I don't know what is my error, either it is on client (Windows or whatever) or on server (Linux) – Dims Nov 24 '16 at 9:48
  • Certificate can be trusted. If it trusted, then it SHOULD work. Also, I have it working on one of machines. – Dims Nov 24 '16 at 11:31
  • No, it is inside my LAN. domain name is fictional (although I probably own it, don't rmemeber) – Dims Nov 24 '16 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.