I want to block certain urls for some users of my internal network. I am using a squid based explicit proxy for this purpose with a redirect_program. The clients are configured to use a pac file for https urls which makes them route their https requests to the explicit proxy.
The problem is, the redirection of any CONNECT request for an https url to a blocked page url fails. I tried both http and https based blocked page urls but could not find any luck. For some reasons, I do not want to use a transparent proxy with ssl bumping.
Safari gives the error 'Safari cannot open the page. The error was "There was a problem establishing a secure tunnel through the web proxy server"'
Chrome gives the error 'This web page is not available. ERR_TUNNEL_CONNECTION_FAILED'.
Here is a line from access.log for https://www.yahoo.com.
07/Oct/2015:01:41:29 -0500 74 18.104.22.168 TCP_REDIRECT/302 253 CONNECT www.yahoo.com:443 - HIER_NONE/- -
I read somewhere that the browser is expecting to start an SSL/TLS handshake after the connect request and that is why it is failing. Here is a qoute from the documentation of squid redirector.
"URL alterations and particularly redirection are only possible on certain methods, and some such as POST and CONNECT require special care."
It does not say redirection is not possible for CONNECT method. However, no where is it mentioned that how can we redirect POST and CONNECT (I am particularly interested in CONNECT) or any example is given.
Please guide me on how to redirect https connect requests to a blocked page. If this is not possible, is there a work around for this with explicit proxy? Thank you.
I am using squid 3.5.4 on ubuntu.