I have configured Squid as a transparent HTTP Egress Proxy, filtering outgoing web traffic based on a whitelist of known good URLs. I am now trying to get it working with HTTPS using the instructions in https://aws.amazon.com/blogs/security/how-to-add-dns-filtering-to-your-nat-instance-with-squid/
However, when I curl from a client machine, I get an Access Denied even if the site is in the whitelist. I assume it's something to do with how I've configured it but I can't see it.
# ACLS acl SSL_ports port 443 acl CONNECT method CONNECT acl http_whitelist dstdomain "/etc/squid/whitelist.txt" acl https_whitelist ssl::server_name "/etc/squid/http_whitelist.txt" # Local Networks acl localnet src 10.0.0.0/8 acl Safe_ports port 80 #http acl Safe_ports port 443 #https http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access deny !localhost !localnet http_access allow http_whitelist http_access deny all refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 refresh_pattern . 0 20% 4320 http_port 3128 transparent #Handling HTTPS requests https_port 3130 cert=/etc/squid/ssl/squid.pem ssl-bump intercept acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 ssl_bump peek step1 all ssl_bump peek step2 https_whitelist ssl_bump splice step3 https_whitelist ssl_bump terminate step2 all
/etc/squid/whitelist.txt # Monitoring tools .datadoghq.com .alertlogic.com
# Updates repo.eu-west-1.amazonaws.com repo.eu-west-2.amazonaws.com repo.eu-west-3.amazonaws.com packages.eu-west-1.amazonaws.com packages.eu-west-2.amazonaws.com packages.eu-west-3.amazonaws.com
I'm getting a ERROR: No forward-proxy ports configured in /var/log/squid/cache.log but this is to be expected if I have 3128 as
transparent isn't it?
I'm also getting some CA/SSL errors:
Error negotiating SSL connection on FD 10: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate (1/0) Error negotiating SSL connection on FD 10: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (1/0)
Again, is this not to be expected since I'm currently using a self-signed cert (running curl on the client with