Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a HTTPS server that expects the client to provide a certificate. This cert uses a passphrase. Everything works fine. But if I use SQUID as my proxy then the authentication fails and squid returns a 503.

Is there anything special I would need to configure in squid? I couldn't find anything in the docs.

I'm getting the following in the squid cache.log

fwdNegotiateSSL: Error negotiating SSL connection on FD 15: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (1/0/0)

-- EDIT--

Well, I found the configuration I needed to add and now it's working as expected:

sslpassword_program /etc/squid/program.sh
sslproxy_client_key /etc/squid/keys/cert.pem

I put my cert.pem into the /keys folder. Then program.sh is a very simple program that prints the passphrase. This is all it has:

#!/bin/sh
echo "mypassphrase"

Restarted squid and now it's working!

share|improve this question
    
Have you configured that certificate and passphrase into squid? –  MadHatter Jul 18 at 15:17
    
I haven't. Should I do it with http_port ? My understanding was that the cert in that directive is for the origin client and not for the destination server. Also couldn't find any "passphrase" option on the squid docs. –  user313551 Jul 18 at 15:24
    
Is your squid proxy in ssl bump mode? Or are your clients configured to point at it, such that HTTPS happens over an HTTP CONNECT? –  Zoredache Jul 18 at 16:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.