We are using Squid proxy server in our environment and we want to cache HTTPS requests.
Is there any way to configure Squid or in general a proxy server to cache HTTPS requests?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
There is a way to do it, but it's fundamentally against the reasons for using HTTPS.
Here's how you'd do it.
I'm not going to give you the exact details of how to do this, because a) I think it's somewhat unethical, and b) It's better for you to learn how to do it.
I suggest you research how stunnel and man-in-the-middle attacks work.
No, there are not: they are encrypted... A workaround would be something like a man-in-middle deployment, but that would defeat all the reasons behind https.
Just to explain why this can't be done without MITM - a proxy only sees the DNS name of the server you want to connect to when using encrypted HTTPS. It does not see the URL, nor any response headers. It cannot determine which individual resource you are accessing on a site, whether or not it is cacheable, nor what it's modification times are. All it can see is someone wants something from a remote server using HTTPS.
This means that caching cannot work as the proxy does not know what cached objects to give you, or how to get them in the first place.
Zeus (Now Riverbed's) ZTM Traffic Manager can do this as it can translate http and https traffic both ways and cache unencrypted content - it works, we use it, but it's fearsomely expensive - as in the price of a Porsche per server.