I'm administrating a corporate web proxy running Squid 3.5.10 on CentOS 7 (a Diladele appliance), doing SSL bumping, and I'm having some trouble with adding new CA certificates to the system trust store, which leads to our users not being able to access several SSL-protected sites that they should be able to. One of those sites is https://www.sexierdating.com/ (yes, it is what it sounds like, but our policy is to not care what people surf during their lunch breaks as long as it's legal).
Error message from Squid is the usual X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
, meaning that for some reason Squid does not trust or can not verify the destination server certificate.
Until now, grabbing the CA root certificate in PEM format from the CA's support pages, putting it into /etc/pki/ca-trust/source/anchors
, running update-ca-trust
and restarting Squid was sufficient to fix the problem - but not in my current case. The ca-certificates package is at the current version, as I just ran a whole yum update on the machine.
All domains that I'm currently having issues with, have a "Go Daddy Secure Certificate Authority - G2" certificate on them. I downloaded every cert from their support page (https://certs.godaddy.com/repository/), installed them as described above, reloaded squid, but the error persists. I even watched update-ca-trust with strace to see if it's really picking up the correct PEM files - and it does.
What weirds me out a bit is that the certs.godaddy.com download page seems to be using the exact same root and intermediate cert as some of the problematic domains, but that page works fine through Squid. When I compare the certs in Firefox, I don't see any difference in the overall spec and algorithms, but still, one works and others don't.
I'm at my wit's end, and hope someone can prod me in the right direction to resolve this.. I can't go add proxy exceptions for every second page with a GoDaddy certificate..