I'm currenty using squid on a pfSense box to intercept SSL which works well. The problem now is that WhatsApp Web will not work throught this proxy because it does not hold up to the Handshake proceedure as expected which causes squid to terminate this connection.
Is it possible to exclude specific targets from SSL interception in squid to prevent this problem?
What you are asking for is not possible. What you are apparently trying to achieve requires doing something else.
Because the interception is actually being done by the pfSense NAT system. Squid is just the process receiving the intercepted TCP connections and performing the TLS decryption parts.
To bypass interception you need to alter the pfSense NAT configuration. Once the packets reach Squid it is too late - the only option then are to proxy or terminate. However, detecting in advance whether any particular TCP SYN packet is going to turn into an HTTPS or WhatsApp connection is a problem. So bypassing the interception is usually not worth the trouble.
So what you actually have to do is to detect these in Squid during the SSL-Bump processing and tunnel (not bypass) the relevant traffic though the proxy.
Squid-3.5 can do that with the "ssl_bump splice" action if the traffic actually is TLS but not decryptable (use the TLS SNI and/or server certificate details to decide on splicing). If that is not sufficient, Squid-4 provides a http://www.squid-cache.org/Doc/config/on_unsupported_protocol/ feature for tunneling traffic that turns out to be non-TLS on port 443.
yes, totally doable and although it might not have been there 7 years ago, there's an example by now, to do exactly that:
# Example: Bump all TLS connections except those originating from
# localhost or those going to example.com.
acl broken_sites ssl::server_name .example.com
ssl_bump splice localhost
ssl_bump splice broken_sites
ssl_bump bump all
