Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a HTTPS server that expects the client to provide a certificate. This cert uses a passphrase. Everything works fine. But if I use SQUID as my proxy then the authentication fails and squid returns a 503.

Is there anything special I would need to configure in squid? I couldn't find anything in the docs.

I'm getting the following in the squid cache.log

fwdNegotiateSSL: Error negotiating SSL connection on FD 15: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (1/0/0)

-- EDIT--

Well, I found the configuration I needed to add and now it's working as expected:

sslpassword_program /etc/squid/
sslproxy_client_key /etc/squid/keys/cert.pem

I put my cert.pem into the /keys folder. Then is a very simple program that prints the passphrase. This is all it has:

echo "mypassphrase"

Restarted squid and now it's working!

share|improve this question
Have you configured that certificate and passphrase into squid? – MadHatter Jul 18 '14 at 15:17
I haven't. Should I do it with http_port ? My understanding was that the cert in that directive is for the origin client and not for the destination server. Also couldn't find any "passphrase" option on the squid docs. – user313551 Jul 18 '14 at 15:24
Is your squid proxy in ssl bump mode? Or are your clients configured to point at it, such that HTTPS happens over an HTTP CONNECT? – Zoredache Jul 18 '14 at 16:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.