Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been upgrading my network from using an apache reverse proxy (Not quite powerful enough) to a Squid proxy configured just for reverse use.

My squid proxy is on a CentOS 6 VM, and currently running alongside my pre-existent apache proxy - so I still have the squid running on port 3128.

I have this setup in my /etc/squid/squid.conf,

http_port 3128 accel vhost
visible_hostname squid

cache_peer 192.168.0.13 parent 80 0 no-query originserver name=server1
cache_peer_domain server1 www.server1.com server1.com

cache_peer 192.168.0.14 parent 80 0 no-query originserver name=server2
cache_peer_domain server2 www.server2.com server2.com

cache_peer 192.168.0.15 parent 80 0 no-query originserver name=server3
cache_peer_domain server3 www.server3.com server3.com

http_access allow all

This works perfectly for all HTTP connections.

It directs

www.server1.com:3128

to

192.168.0.13:80

I have been trying to implement SSL certs for two of the three domains. Last night I managed to get some successful config for a fully working HTTPS connection to one of my domains.

I added this config before the HTTP settings:

https_port 443 accel ssl-bump transparent vhost cert=/usr/ssl/CA/server1.crt key=/usr/ssl/CA/server1.key

cache_peer 192.168.0.12 parent 443 0 no-query originserver login=PASS ssl sslflags=DONT_VERIFY_PEER name=server1_ssl
cache_peer_domain server1_ssl ssl www.server1.com server1.com

This seemed to be ok last night. It would connect to

https:// www.domain1.com

fully encrypted. Because of one of the options (trial and error - can't remember which), it decrypts the packets, and directs the HTTPS request to the correct VM. The VM already had the SSL cert installed, so would recognise HTTPS requests, and the whole pageload from start to finish was encrypted.

I could visit https:// www.domain2.com and it would say the connection was partially encrypted, and would show a cert error, that the cert was for www.domain1.com

However, today, this was really interfering with the HTTP connection to domain1, and my browser was saying the page was being redirected in a way that will never complete.

I have since removed the whole SSL connection config from the config file, and I am running standard HTTP only.

Are there any ways I can get https:// www.domain1.com to read cert domain1.crt and direct to domain1's VM, and https:// www.domain2.com to read cert domain2.crt and direct to domain2's VM ?

Sorry for such a long question, but its a very specific issue I have been having, and I tried to give as much info as possible.

Thanks

share|improve this question
    
I don't think Squid properly supports this scenario. Better to use a more well developed reverse proxy, such as nginx, varnish, etc. –  Michael Hampton Nov 17 '13 at 18:17
    
@MichaelHampton Thanks, I wasnt aware nginx had the capabilities. I was under the impression it was a PIMPed up version of apache... A google search found me this... digitalocean.com/community/articles/… ... Looks very interesting... Thanks ! –  DJ-P.I.M.P Nov 17 '13 at 18:56
    
nginx does reverse proxying and caching and SSL termination with SNI support. It's probably your best bet if you want a single package. –  Michael Hampton Nov 17 '13 at 19:02
    
ive been trying to install nginx with SNI support on centos 6 with no joy,,, package isnt in YUM, so added repo... Didnt come with SNI support. Had major issues trying to set the flag on ./configure section, to compile with SNI... Its never easy for us programmers, is it ? :) –  DJ-P.I.M.P Nov 17 '13 at 23:22
    
The nginx from their repo certainly supports SNI out of the box. You should start over. –  Michael Hampton Nov 17 '13 at 23:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.