I have lots of servers which access various external webservices, most of which use SSL, some of which require client certificates. I would like to centralize the configuration of client certs and dissociate the presentation layer from the underlying servers.

While I could use Squid to proxy the requests, I can't see from the docs how to tell Squid to select a client certificate specific to the target webservice. Is this possible?

One approach would be to maintain a gang of stunnel instances beyond the Squid proxy, then configure the client software to use http requests with a URL rewriter to route the request via the appropriate stunnel instance, however that will break if I get a XML response referencing a HTTPS DTD (unless I rewrite the content with a full MITM).

Is there another solution?


The problem with re-writing 'https' to 'http' is that it then breaks any additional resources with an http URI - since the protocol adapter will then convert these back to https!

I came across this article which addressed the problem of adding a client certificate to a proxied connection - which is potentially a solution. But does require that the client be configured to use a proxy, there are also problems around naming things and how to get it working with split DNS. Admittedly not huge problems, but it got me thinking that what I am describing here is the pattern used by most CDN providers - hence I am currently considering using Apache Traffic Server as the intermediate component - this allows use of split DNS, seperate SSL channels between the client and the origin, and client certificates for the communication with the origin server.


Squid-in-the-middle decryption and encryption of straight CONNECT and transparently redirected SSL traffic, using configurable CA certificates.


  • How does this tell Squid how to select a client certificate specific to the target webservice? – symcbean Mar 15 '15 at 20:08
  • Oh, it seems they have not yet created all ACLs you need. My apologies. – ZGV Mar 15 '15 at 21:26

After digging in further I decided to use back to back instances of pound. I also considered using stunnel or haproxy, but pound deals with the SSL stuff and has a basic capacity for manipulating http headers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.