I use Squid and the users must authenticate. The users are authenticating in cleartext. I found tutorials about stunnel (http://www.jeffyestrumskas.com/?page_id=3), but the clients also need this software.

Is there no possibility that for user authentication SSL (or some other encryption technology) can be used?.


3 Answers 3


You could use HTTP Digest authentication with squid. This way the passwords would not be passed clear-text. This is quite easy to configure, no certificated needed, little overhead. I have successfully used it for some time in a small company.

There are some problems with this approach, though:

  • Many HTTP clients have digest authentication implementation broken.
  • You will probably not be able to use your current ('encrypted') password database.

See http://squid-web-proxy-cache.1019090.n4.nabble.com/Simple-Kerberos-Squid-configuration-received-type-1-NTLM-token-td2553379.html#a2553379.

Using SSO (Kerberos) with Firefox as client (on a Windows Xp client and Linux server with Kerberos and no AD and no LDAP if not needed) is a solution.


You can create an ACL using the user_cert ACL Type in squid.conf.

acl ssl_authentication user_cert somecertattributevalue

Then create filters using that ACL.

http_access deny all
http_access allow ssl_authentication
  • Can you give more information? Where must the "user_cert" option be used. Nothing on the internet about this, besides the few paragrpahes int he documentation (visolve.com/squid/squid26/accesscontrols.php#user_cert).
    – user28362
    Jan 28, 2010 at 14:16
  • @barbarossa12d: sorry, I forgot to include that! It goes in the acl directive. I've edited to include.
    – squillman
    Jan 28, 2010 at 15:32
  • I have: "acl myacl user_cert src" It gives at startup the following error: aclParseAclLine: Invalid ACL type 'user_cert'. I am using Squid 2.7 on Debian. Thanks for your help.
    – user28362
    Jan 29, 2010 at 7:49
  • Anyone? Just an example will do it.
    – user28362
    Feb 3, 2010 at 10:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .