I've got many servers and I want them to have the same IP when they do requests via the Internet. So I configured a Squid http proxy server that works well for http requests. The problem is that it do not works for HTTPS requests (the real IP of my server appears...).

Do you have a solution for that ?

  • What is the base operating system that squid runs on..?? Meanwhile, I'd suggest you install webmin for easier view and configuration or if the purpose it to act as proxy server along with some enhanced features, pfsense will do better. Having said that, I found this by googling which may server you. – AzkerM Apr 14 '14 at 12:25
  • can you show your squid configuration? – c4f4t0r Apr 14 '14 at 12:54
  • My server runs on Debian 7. I'll try webmin ! And thanks for the link ! – maxime Apr 16 '14 at 13:29

You need to use the SSL Bump functionality of Squid in order to be able to filter HTTPS. An easy method to implement this is to use QLProxy as it has the SSL Bump functionality enabled by default.

If you'd like to add it to your existing configuration, you can research it here

SIDE NOTE : SSL was developed, in part, to issue assurances to the connecting party that they are connecting to the service that they are expecting to connect to. Intercepting this transmission, which is what you're trying to accomplish, will break the integrtity of HTTPS and issue certificate warnings to your clients. This can be mitigated by distributing a trusted certificate to all your clients, however there is an ethical issue at play here as you are essentially eavesdropping on traffic that your clients assume is secure.

  • He doesn't need a transparent proxy. – Diego Woitasen Apr 15 '14 at 17:00
  • @diegows perhaps you'd care to share what you think he needs then rather than just stating what they "don't" need. – DKNUCKLES Apr 16 '14 at 12:47

Here is now my ssl-bump rules are setup and it works without a problem:

http_port 3128
http_port 3129 intercept
https_port 3130 intercept ssl-bump connection-auth=off generate-host-certificates=on dynamic_cert_mem_cache_size=8MB cert=/etc/squid/ssl/squid.pem key=/etc/squid/ssl/squid.key cipher=ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:AES128-SHA:RC4-SHA:HIGH:!aNULL:!MD5:!ADH
sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/squid_ssl_db -M 8MB
sslcrtd_children 50 startup=5 idle=1
ssl_bump server-first all
ssl_bump none localhost

Then just set both HTTP and SSL proxy to the server and port 3128.


If you only want to forward requests through a static IP, the basic squid config (without ssl_bump) should work fine.

You use it this way combined with ACL rules and authentication:

https_port 8443 cert=/etc/certs/proxy-fullchain.pem key=/etc/ssl/private/proxy.key

So I can request through proxy server this way:

curl --proxy https://user:pass@proxy.example.com:8443 https://target.example.com

If you need to intercept the connection to apply rules based on its content, so you'll need to intercept SSL Interception

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.