Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At the moment I redirect http(443) requests into squid configured https_port. It works as expected. It terminate ssl connection with the ssl certificate installed in Squid. And then proxies traffic.

In this setup, end users get illegal certificate errors, of course.

I want to established a local CA and install public certificate of this local CA into end user client PCs. Squid should get the target domain name, it should create a ssl certificate for that target domain in the local ca on the fly. Because I installed CA public certificate in Trusted Root Certificate Authorities in the client PC, client IE will not give any errors, trust the site certificate and provides real tranparent https proxying.

An open source tool, imspector, does the same setup successfully for another aim.

I try to find a way of implementing such setup with squid and I need your kind comments.

share|improve this question
Are you trying to create an official Man-In-The-Middle in your network (I hope you've warned your users)? Note that normally, an HTTP proxy doesn't interfere with the HTTPS traffic, it uses CONNECT to relay it all. – Bruno Jun 14 '11 at 9:51
Yes. Of course we warn the users. – seaquest Jun 14 '11 at 10:13
We use squid as https_proxy also. The configuration directive is https_port 8443 ..... The problem is wedo not want squid pucsh a single certificate for each request. We want it to create certificate specific to the target web server, on the fly. – seaquest Jun 14 '11 at 10:16

If your users are on an active directory domain you can push the certificate on the proxy out to the workstations using group policy.

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies/Trusted Root Certification Authorities.

Put your .der certificate in there.

share|improve this answer
Despite the fact that this question is almost two years old (and flagged has an accepted answer), your suggestion doesn't solve the author's question. They want to dynamically create certificates for proxied sites, not distribute their own Root Cert. – Lukas Mar 18 '13 at 2:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.