Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to get a transparent https proxy setup working. I'm not looking to intercept or anything, I would like the https traffic to just be forwarded to the real host.

In squid I have something like: https_port 3130 cert=/etc/ssl/certs/host1.crt key=/etc/ssl/private/host1.key

However when I make a web request I'm prompted with the ssl certificate is invalid warning screen.

Am I doing something wrong? I tried adding 'transparent' to https_port and squid 3.4 won't start.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You have to generate a certificate request and then get it signed by a certification authority. You will have to use openssl for that.

You also have to redirect https incoming traffic from port 443 to port 3130. I think iptables is most suitable for that.

I would suggest to read this : http://ajayadas.com/e110body-anchor/

Hope this helps a little.

share|improve this answer
    
I've done both. Let's say I have a cert like myhost.crt. If I visit anotherhost.com I get an error that the certificate is for myhost.crt and not anotherhost.com. –  MB. Dec 14 '13 at 16:01
    
Normal behaviour ! you can add alternates names to your certificate request : add anotherhost.com as an alternate name to your request –  krisFR Dec 14 '13 at 16:03
    
If that's the case the user would have to accept a root CA. –  MB. Dec 14 '13 at 16:14
    
yep, the user will have to accept the root CA. To avoid this you can use real CA like Verisign or Digicert but it has a cost ! –  krisFR Dec 14 '13 at 17:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.