Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get a transparent https proxy setup working. I'm not looking to intercept or anything, I would like the https traffic to just be forwarded to the real host.

In squid I have something like: https_port 3130 cert=/etc/ssl/certs/host1.crt key=/etc/ssl/private/host1.key

However when I make a web request I'm prompted with the ssl certificate is invalid warning screen.

Am I doing something wrong? I tried adding 'transparent' to https_port and squid 3.4 won't start.

share|improve this question
up vote 2 down vote accepted

You have to generate a certificate request and then get it signed by a certification authority. You will have to use openssl for that.

You also have to redirect https incoming traffic from port 443 to port 3130. I think iptables is most suitable for that.

I would suggest to read this :

Hope this helps a little.

share|improve this answer
I've done both. Let's say I have a cert like myhost.crt. If I visit I get an error that the certificate is for myhost.crt and not – MB. Dec 14 '13 at 16:01
Normal behaviour ! you can add alternates names to your certificate request : add as an alternate name to your request – krisFR Dec 14 '13 at 16:03
If that's the case the user would have to accept a root CA. – MB. Dec 14 '13 at 16:14
yep, the user will have to accept the root CA. To avoid this you can use real CA like Verisign or Digicert but it has a cost ! – krisFR Dec 14 '13 at 17:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.