I have configured Squid as a transparent HTTP Egress Proxy, filtering outgoing web traffic based on a whitelist of known good URLs. I am now trying to get it working with HTTPS using the instructions in https://aws.amazon.com/blogs/security/how-to-add-dns-filtering-to-your-nat-instance-with-squid/

However, when I curl from a client machine, I get an Access Denied even if the site is in the whitelist. I assume it's something to do with how I've configured it but I can't see it.


 acl SSL_ports port 443
 acl http_whitelist dstdomain "/etc/squid/whitelist.txt"
 acl https_whitelist ssl::server_name "/etc/squid/http_whitelist.txt"

 # Local Networks
 acl localnet src

 acl Safe_ports port 80 #http
 acl Safe_ports port 443 #https

 http_access deny !Safe_ports
 http_access deny CONNECT !SSL_ports
 http_access allow localhost manager
 http_access deny manager
 http_access deny !localhost !localnet
 http_access allow http_whitelist
 http_access deny all

 refresh_pattern ^ftp: 1440 20% 10080
 refresh_pattern ^gopher: 1440 0% 1440
 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
 refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
 refresh_pattern . 0 20% 4320

 http_port 3128 transparent

 #Handling HTTPS requests
 https_port 3130 cert=/etc/squid/ssl/squid.pem ssl-bump intercept

 acl step1 at_step SslBump1
 acl step2 at_step SslBump2
 acl step3 at_step SslBump3
 ssl_bump peek step1 all
 ssl_bump peek step2 https_whitelist
 ssl_bump splice step3 https_whitelist
 ssl_bump terminate step2 all

/etc/squid/whitelist.txt # Monitoring tools .datadoghq.com .alertlogic.com

 # Updates

I'm getting a ERROR: No forward-proxy ports configured in /var/log/squid/cache.log but this is to be expected if I have 3128 as transparent isn't it?

I'm also getting some CA/SSL errors:

 Error negotiating SSL connection on FD 10: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate (1/0)
 Error negotiating SSL connection on FD 10: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (1/0)

Again, is this not to be expected since I'm currently using a self-signed cert (running curl on the client with -k)?

  • To solve the forward-proxy ports error I changed http_port 3128 to not have transparent, added http_port 3129 transparent, and forwarded HTTP traffic to that. But this still does not solve the issue. I have seen some comments that the issue might be the HTTPS server refusing the self-signed cert from the squid. Does that seem right? – Sean Hederman Jan 7 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.