1

I am attempting to install Squid 3.5.2 to utilize improved sslbump functionality with websites with HSTS. I'm following the documentation on a fresh CentOS 7 VM installation. The issue I'm having is that there is no ssl_crtd folder created when Squid is installed, despite the fact the rpm appears to have been configured with the appropriate switches.

See below for output of Squid -v

[root@squid]# squid -v
Squid Cache: Version 3.5.2
Service Name: squid
configure options:  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos,wrapper' '--enable-external-acl-helpers=wbinfo_group,kerberos_ldap_group,AD_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-icap-client' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-storeio=aufs,diskd,ufs,rock' '--enable-wccpv2' '--enable-esi' '--enable-ssl-crtd' '--enable-icmp' '--with-aio' '--with-default-user=squid' '--with-filedescriptors=16384' '--with-dl' '--with-openssl' '--with-pthreads' '--with-included-ltdl' '--disable-arch-native' '--without-nettle' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic' 'LDFLAGS=-Wl,-z,relro ' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -fPIC' 'PKG_CONFIG_PATH=%{_PKG_CONFIG_PATH}:/usr/lib64/pkgconfig:/usr/share/pkgconfig' --enable-ltdl-convenience

Does anyone know why that folder, which as I've read in almost all documentation should be there is strangely absent?

EDIT :

The directory I'm looking for is the ssl_crtd directory. From the documentation I've read it appears as though it should be located in /usr/lib64/squid/ssl_crtd. Trying to locate it with the find / -name "ssl_*" (and other variations) command turns up nothing either.

2
  • Exactly what directory are you looking for? Apr 6, 2015 at 18:38
  • @MichaelHampton Edited for clarity - sorry about the omission.
    – DKNUCKLES
    Apr 6, 2015 at 18:46

4 Answers 4

3

ssl_crtd is a binary it is built in the squid-helpers rpm build see: squid.spec.

%files helpers
%{_libdir}/squid/basic_db_auth
%{_libdir}/squid/basic_getpwnam_auth
%{_libdir}/squid/basic_ldap_auth
%{_libdir}/squid/basic_ncsa_auth
%{_libdir}/squid/basic_nis_auth
%{_libdir}/squid/basic_pam_auth
%{_libdir}/squid/basic_pop3_auth
.........
%{_libdir}/squid/ssl_crtd

If you want it installed in the general squid rpm you must modify the squid.spec file to copy the lib installer into the %files section of the spec file or install squid-helpers.rpm

1
  • Installing the squid-helpers.rpm resolved the issue. Thanks!
    – DKNUCKLES
    Aug 30, 2015 at 13:08
0

You must created the certificate storage yourself. Type the following commands to do it (these are for Ubuntu but CentOS should be quite similar):

$ sudo rm -R -f /var/spool/squid3_ssldb
$ sudo /bin/ssl_crtd -c -s /var/spool/squid3_ssldb
$ sudo chown -R proxy:proxy /var/spool/squid3_ssldb

Finally restart your Squid proxy.

$ sudo service squid3 restart

More info at http://docs.diladele.com/administrator_guide_4_1/system_configuration/https_filtering/generate_certificates.html

1
  • 3
    Hi Rafael - Unfortunately step 2 doesn't work in this example as the /bin/ssl_crtd directory does not exist. Does that need to be manually created as well?
    – DKNUCKLES
    Apr 8, 2015 at 0:45
0

Visit http://roberts.bplaced.net/index.php/linux-guides/centos-6-guides/proxy-server/squid-transparent-proxy-http-https

STEP 2 - Enable EPEL repo, install SQUID

CentOS provided SQUID does not have ssl_crtd for some reason, ...

1
  • and "yum install squid-helpers" Dec 28, 2017 at 3:27
-1

The ssl_crtd is in the squid-helpers package. In an x86_64 installation, it is found in path /usr/lib64/squid/ssl_crtd

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.