Important: I have this question on stackoverflow but somebody told me this is more relevant place for this question. Thanks
I have configured squid(3.4.2) as ssl bumped proxy. I am setting proxy in firefox(29) to use squid for https/http. Now it works for most sites, but some sites which support old SSL proto(sslv3) break, and I see squid not employing any workarounds for those like browsers do.
As a workaround I have set sslproxy_version=3 , which enforces SSLv3 and above sites work.
My question: is there a better way to do this which does not involve enforcing SSLv3 for servers supporting TLS1 or better.
Now I know openssl doesn't automatically handle that. But I imagined squid would.
My squid conf snipper:
http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/certs/SquidCA.pem
always_direct allow all ssl_bump server-first all sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s /usr/local/squid/var/lib/ssl_db -M 4MB
client_persistent_connections on server_persistent_connections on
cache_dir aufs /usr/local/squid/var/cache/squid 100 16 256
refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320
UPDATE: I have tried compiling squid 3.4.5 with openssl 1.0.1h . No improvements