Debian 10 with squid working as a transparent proxy. Now want to add SSL.
# apt-get install openssl # mkdir -p /etc/squid/cert # cd /etc/squid/cert # openssl req -new -newkey rsa:4096 -sha256 -days 365 -nodes -x509 -keyout myCA.pem -out myCA.pem # openssl x509 -in myCA.pem -outform DER -out myCA.der # # iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to 192.168.1.51:3129 # iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j REDIRECT --to-port 3129 # iptables-save > /etc/iptables/rules.v4
Question 1: Now what I read says that next I need to
/usr/lib/squid/security_file_certgen -c -s /var/cache/squid/ssl_db -M 4MB
however I cannot find
security_file_certgen on my system.
Question 2: If I now proceed anyway to add in
https_port 3129 intercept ssl-bump cert=/etc/squid/cert/myCA.pem generate-host-certificates=on
then squid fails to start:
2020/10/07 14:09:27| FATAL: Unknown https_port option 'ssl-bump'. 2020/10/07 14:09:27| FATAL: Bungled /etc/squid/squid.conf line 5: https_port 3129 int 2020/10/07 14:09:27| Squid Cache (Version 4.6): Terminated abnormally. CPU Usage: 0.017 seconds = 0.017 user + 0.000 sys Maximum Resident Size: 57792 KB Page faults with physical i/o: 0 FATAL: Bungled /etc/squid/squid.conf line 5: https_port 3129 intercept ssl-bump cert= squid.service: Control process exited, code=exited, status=1/FAILURE squid.service: Failed with result 'exit-code'. Failed to start Squid Web Proxy Server.
I notice that
squid -v contains neither
--with-openssl, but I don't understand what to do about this.
All of the guides on the Internet at the time of writing are obsolete because
has been replaced with https://wiki.squid-cache.org/Features/BumpSslServerFirst
has been replaced with
I was hoping this might work that I got from https://serverfault.com/questions/743483/transparent-http-https-domain-filtering-proxy :
https_port 3129 intercept ssl-bump ssl_bump peek all ssl_bump splice all
2020/10/08 09:57:49| FATAL: Unknown https_port option 'ssl-bump'. 2020/10/08 09:57:49| FATAL: Bungled /etc/squid/squid.conf line 6: https_port 3129 int 2020/10/08 09:57:49| Squid Cache (Version 4.6): Terminated abnormally. CPU Usage: 0.017 seconds = 0.008 user + 0.008 sys Maximum Resident Size: 57152 KB Page faults with physical i/o: 0 FATAL: Bungled /etc/squid/squid.conf line 6: https_port 3129 intercept ssl-bump squid.service: Control process exited, code=exited, status=1/FAILURE squid.service: Failed with result 'exit-code'. Failed to start Squid Web Proxy Server.
Update: compiling squid with SSL
# cd ~ # mkdir squid-build # cd squid-build # apt-get install openssh-server net-tools # apt-get install openssl devscripts build-essential fakeroot libdbi-perl libssl-dev# libssl1.0-dev # apt-get install dpkg-dev # apt-get source squid # apt-get build-dep squid # cd squid-4.6/ # vi debian/rules # dpkg-source --commit
debian/rules file add to
DEB_CONFIGURE_EXTRA_FLAGS the flags:
--with-default-user=proxy \ --enable-ssl \ --enable-ssl-crtd \ --with-openssl \ --disable-ipv6
# debuild -us -uc
# cd .. # pwd /root/squid-build # mv squid3*.deb squid3.deb.NotIncluded # dpkg -i *.deb
However, still no
Has it been renamed to
Update: compiled squid
Got squid compiled and running for HTTP but don't know what to do for HTTPS -- and nor apparently does anyone else. Is it impossible? It seems to be something to do with certificates and