I have an issue with setting up a transparent Squid proxy on a pfsense firewall. I created a CA for HTTPS MITM, installed it in my browser and it works with most websites.
However sites like ubuntuusers.de use a let's encrypt certificate seem to cause problems. The strange thing is that it seems to be correct: Its CN is the domain and their CA is correctly Let's Encrypt Authority X3.
However as soon as the Squid proxy intercepts the certificate and MITM's it to it's own ca the CN of the certificate becomes the IP number of ubuntuusers.de and thus the browsers, both Chrome and Firefox reject it since cn and
domain don't fit (net::ERR_CERT_COMMON_NAME_INVALID)
This only happens on this site so it has to do something with this certificate. I am not experienced enough with certificates to understand why this is happening.
... Common Name (CN) 220.127.116.11 Organization (O) <Not Part Of Certificate> Organizational Unit (OU) <Not Part Of Certificate> Serial Number 7C... Issued By Common Name (CN) myown-ca ...
Maybe someone can explain this behaviour to me?