Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We do not want to know what is inside the package. Only monitor the destination URLs. Is it possible?

In other words: I want the Squid log accesses without being transparent proxy.

share|improve this question
up vote 2 down vote accepted

SSL/TLS was designed for end-to-end security.

By default, most user agents will warn end-users about a possible man-in-the-middle attack (c) Squid wiki

Without SSl Bump/Dynamic certificate generation you will only see CONNECT and base domain part of url

Just like this

1352350302.532 1002 TCP_MISS 200 30185 CONNECT - HIER_DIRECT - 443 "Opera/9.80 (X11; Linux x86_64; U; en) Presto/2.10.289 Version/12.02

Instead of whole url like,or.&fp=61092a4c975e159e&num=100&q=asdasd&safe=off

Why is it so? Because HTTP header might contain some sensitive data, including session id (some ugly cases) and you might get access to the webpage/my session without my authorization, and because it's privacy - I don't want you to know that I am visiting some hidden porn sites :D

So, you (Squid) MUST know what is inside of package. In some countries this might be illegal.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.