Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am tying to redirect a specific https request to somewhere else. I've been trying to use squid which worked for http, but it's unable to see https request. Is it even possible to do this as the request is already encrypted and squid can't even see it.

I've tried using squid with and without squirm without success. Checking squid logs, only http requests are logged and no https are logged, meaning https are not going through squid?

I've tried the trick here http://www.rahulpahade.com/content/squid-transparent-proxy-over-ssl-https. As soon as I enable the firewall settings, all requests to https are blocked. But if disable forwarding 443 to squid server without any changes to the squid config, it's working again.

Please help. Thanks

share|improve this question

2 Answers 2

Yes, you can perform this, but it isn't exactly trivial.

First, you need to establish a certificate authority that trusted by the client. Once oyu have done that, you can use the sslbump feature of Squid to perform the decryption (see http://wiki.squid-cache.org/Features/SslBump).

While you do not explain the context of what you want to do, it is probably worthwhile mentioning that if what you want to do is debug outgoing HTTPS connections coming from a windows machine, you can perform this in a much simpler way by using the Fiddler web debugger (http://www.fiddler2.com/fiddler2/)

share|improve this answer
    
What I wanted to do is redirecting some https websites to an internal site. An example of this is https :// something.com to http :// not-allowed.localdomain.com . While this is easy for http using squid, I haven't been able to do it for https. I will try using ssl-bump when I got home. Thanks! –  Adrian Gunawan Aug 23 '12 at 22:56

Due to the nature of HTTPS, it is not possible to proxy outgoing connections transparently.

Since HTTPS connections are secured on the networking level, any attempt to intercept them will be detected, and will break the communication.

It is possible to proxy SSL if the end-user connects to the proxy directly, since the proxy will simply set up the secure connection itself; however, you cannot transparently proxy a secure connection, because the proxy does not have access to the same certificate as the real server - it cannot impersonate it.

share|improve this answer
1  
While this is correct, it would help others understand if you elaborate on why. –  Patrick Aug 23 '12 at 12:58
    
My answer was a generous WAG because he provides next to no actual information that could help us help him. The clue lies in the "outgoing" part. –  adaptr Aug 23 '12 at 13:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.