We do not want to know what is inside the package. Only monitor the destination URLs. Is it possible?

In other words: I want the Squid log accesses without being transparent proxy.


SSL/TLS was designed for end-to-end security.

By default, most user agents will warn end-users about a possible man-in-the-middle attack (c) Squid wiki

Without SSl Bump/Dynamic certificate generation you will only see CONNECT and base domain part of url

Just like this

1352350302.532 1002 TCP_MISS 200 30185 CONNECT www.google.ge:443 - HIER_DIRECT - 443 "Opera/9.80 (X11; Linux x86_64; U; en) Presto/2.10.289 Version/12.02

Instead of whole url like https://www.google.ge/#bav=on.2,or.&fp=61092a4c975e159e&num=100&q=asdasd&safe=off

Why is it so? Because HTTP header might contain some sensitive data, including session id (some ugly cases) and you might get access to the webpage/my session without my authorization, and because it's privacy - I don't want you to know that I am visiting some hidden porn sites :D

So, you (Squid) MUST know what is inside of package. In some countries this might be illegal.

  • Squid 3.5 and later uses SslPeekAndSplice instead of SSlBump – Xiao Jun 20 '19 at 14:02
  • may need to build squid from source. here's a howto – Xiao Jun 20 '19 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.