2

I'm trying to get a transparent https proxy setup working. I'm not looking to intercept or anything, I would like the https traffic to just be forwarded to the real host.

In squid I have something like: https_port 3130 cert=/etc/ssl/certs/host1.crt key=/etc/ssl/private/host1.key

However when I make a web request I'm prompted with the ssl certificate is invalid warning screen.

Am I doing something wrong? I tried adding 'transparent' to https_port and squid 3.4 won't start.

1 Answer 1

2

You have to generate a certificate request and then get it signed by a certification authority. You will have to use openssl for that.

You also have to redirect https incoming traffic from port 443 to port 3130. I think iptables is most suitable for that.

I would suggest to read this : http://ajayadas.com/e110body-anchor/

Hope this helps a little.

4
  • I've done both. Let's say I have a cert like myhost.crt. If I visit anotherhost.com I get an error that the certificate is for myhost.crt and not anotherhost.com.
    – MB.
    Dec 14, 2013 at 16:01
  • Normal behaviour ! you can add alternates names to your certificate request : add anotherhost.com as an alternate name to your request
    – krisFR
    Dec 14, 2013 at 16:03
  • If that's the case the user would have to accept a root CA.
    – MB.
    Dec 14, 2013 at 16:14
  • yep, the user will have to accept the root CA. To avoid this you can use real CA like Verisign or Digicert but it has a cost !
    – krisFR
    Dec 14, 2013 at 17:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .