2

TL:DR; Squid v5.7 is not including the Issuer in the generated certificate

In the past I've been able to do HTTPS data caching by:

  1. building squid with:
VERSION='4.11' ./configure --with-openssl --enable-ssl-crtd' ...
  1. And creating a self signed certificate
sudo openssl req -new -newkey rsa:2048 -nodes \
-x509 -sha256 -extensions v3_ca -days 365 \
-keyout squid-ca-key.pem -out squid-ca-cert.pem \
-subj "/C=AU/ST=WA/L=Perth/O=ACME Pty Ltd/OU=Innovation/CN=squid.d2i.net.au/[email protected]"
  1. changing ownership to the proxy user squid (redhat) or proxy (ubuntu)

  2. And setting the squid.conf with:

http_port 3128 \
  ssl-bump \
  generate-host-certificates=on \
  dynamic_cert_mem_cache_size=4MB \
  cert=/opt/squid-4.11/certs/squid-ca-cert-key.pem

sslcrtd_program /opt/squid-4.11/lib/security_file_certgen \
   -s /opt/squid-4.11/var/swap/ssl_db -M 16MB

acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all
ssl_bump splice all

However the settings recently with Squid v5.7 has been causing me difficulty as Squid, although generating certificates dynamically has been leaving the Issuer: value blank. As you can see from the openssl s_client output: Empty Certificate Issuer

A full example of downloading a file is:

openssl s_client \
-proxy squid.d2i.net.au:3128 -servername github.com \
-connect https://github.com/neovim/neovim/releases/download/v0.4.4/nvim-linux64.tar.gz

attempting to download a file

Are there any ideas why the Squid Service might not be providing a valid Certificate back to my client? Services like curl are returning errors like this:

sudo curl --proxy squid.d2i.net.au:3128 https://github.com

curl: (60) SSL: couldn't get X509-issuer name More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.

1 Answer 1

0

This was easier than I expected: I'd forgotten to add the -subj flag creating the certificate, or as I was doing it for the first time in Ansible I needed the common_name value (in spite of it being created successfully):

- name: Create certificate signing request (CSR) for new certificate
  community.crypto.openssl_csr_pipe:
    common_name: "{{ inventory_hostname }} personal computer"
    privatekey_path: "{{ key_dir }}/{{ inventory_hostname }}.key"
    basic_constraints:
      - 'CA:TRUE'
      - 'pathlen:0'
    basic_constraints_critical: yes
    subject_alt_name:
      - "DNS:{{ inventory_hostname }}.localdomain"
  run_once: true
  register: csr

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .