I'm trying to get a transparent https proxy setup working. I'm not looking to intercept or anything, I would like the https traffic to just be forwarded to the real host.

In squid I have something like: https_port 3130 cert=/etc/ssl/certs/host1.crt key=/etc/ssl/private/host1.key

However when I make a web request I'm prompted with the ssl certificate is invalid warning screen.

Am I doing something wrong? I tried adding 'transparent' to https_port and squid 3.4 won't start.

1 Answer 1


You have to generate a certificate request and then get it signed by a certification authority. You will have to use openssl for that.

You also have to redirect https incoming traffic from port 443 to port 3130. I think iptables is most suitable for that.

I would suggest to read this : http://ajayadas.com/e110body-anchor/

Hope this helps a little.

  • I've done both. Let's say I have a cert like myhost.crt. If I visit anotherhost.com I get an error that the certificate is for myhost.crt and not anotherhost.com.
    – MB.
    Dec 14, 2013 at 16:01
  • Normal behaviour ! you can add alternates names to your certificate request : add anotherhost.com as an alternate name to your request
    – krisFR
    Dec 14, 2013 at 16:03
  • If that's the case the user would have to accept a root CA.
    – MB.
    Dec 14, 2013 at 16:14
  • yep, the user will have to accept the root CA. To avoid this you can use real CA like Verisign or Digicert but it has a cost !
    – krisFR
    Dec 14, 2013 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.