I am trying to test the ssl_bump server_first Squid directive, but I did not understand how it works. As far as I understood the ssl_bump directive has three working modes:
- None: HTTPS traffic is not intercepted, the client connects directly with the remote server, squid only forwards the traffic.
- Client first: The client connects to Squid via SSL (so at the first connection the user has to accept the SSL certificate of Squid), and Squid connects to the server, automatically accepting its SSL certificate. (Or are there options to accept only some certificates and refuse others?)
- Server first: Squid connects to the server, it accepts the SSL certificate, then...? Squid documentation says:
Establish a secure connection with the server first, then establish a secure connection with the client, using a mimicked server certificate.
What does 'mimicked server certificate' mean? Squid produces a fake certificate copying (?) the one received from the remote server? I tried to set up a ssl_bump server_first Squid, but every time that I connect to an HTTPS site the browser warns me that the certificates are mismatching, and if I examine the certificate I see that is always the same one, created during Squid installation...I don't see any difference with the "Client first" behaviour then...
I know that SSL intercepting is not a safe procedure, but I am explorying this feature because I might be forced to use it...
Thank you in advance.