Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup a SSL proxy for one of my internal servers to visit using Squid, to make my Rails application on that server to reach via the proxy.

I am new to this, so my approach is to setup a SSL transparent proxy with Squid. I build Squid 3.3 on Ubuntu 12.04, generated a pair of ssl key and crt, and configure squid like this:

http_port 443 transparent cert=/home/larry/ssl/server.csr key=/home/larry/ssl/server.key

And leaves almost all other configurations default. The authorization of the dir that holds key/crt is drwxrwxr-x 2 proxy proxy 4096 Oct 17 15:45 ssl

Back on my dev laptop, I put <proxy-server-ip> in my /etc/hosts to make the call goes to my proxy server.

But when I try it in my rails application, I got:

SSL_connect returned=1 errno=0 state=SSLv2/v3 read server hello A: unknown protocol

And I also tried with openssl in cli:

openssl s_client -state -nbio -connect 2>&1 | grep "^SSL"
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:error in SSLv2/v3 read server hello A
SSL_connect:error in SSLv2/v3 read server hello A

Where did I do wrong?

share|improve this question

Does this file really contain your cert?


If you're following standard conventions, that's your CSR, certificate signing request, that you sent to your SSL vendor. The SSL vendor, in return, gave you a certificate (often .crt) file that you need to use here.

share|improve this answer
No, that's not from a SSL vendor, it's a self signed csr. – larryzhao Nov 21 '13 at 2:17
But a csr is usually a certificate signing request, not the certificate itself. – Christopher Perrin Oct 11 '14 at 12:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.