Re: [squid-users] Squid and SSL interception (ssl-bump)

On 10/31/2012 6:43 PM, Heinrich Hirtzel wrote:
>
> I've just updated to the most recent squid version (compiled with --enable-ssl *and* --enable-ssl-crtd):
> ./squid -v
> Squid Cache: Version 3.2.3-20121031-r11695
>
what are all the compilation options from -v (curios)
try the latest stable at:
http://www.squid-cache.org/Versions/v3/3.2/squid-3.2.3.tar.bz2

> I can start squid without any errors, but when I try to connect to the daemon the connection gets terminated immediately (using the same cfg as before):
>
> $ telnet 10.0.1.1 3128
> Trying 10.0.1.1...
> Connected to 10.0.1.1.
> Escape character is '^]'.
> Connection closed by foreign host.
>
> While cache.log shows:
> <timestamp> kid1| BUG: Orphan Comm::Connection: local=10.0.1.1:3128 remote=10.0.1.1:51288 FD 10 flags=33
> <timestamp> kid1| NOTE: 1 Orphan since last started
>
> Unfortunately I have no idea what Squid tries to tell me.... In fact HTTP and HTTPS are not working now :-(
>
> Ideas?
>
what are your config now?
what about: sslcrtd_program ?

as I mentioned before you use https only for reverse proxy.(3.2)
did you took your time to look at "Limitations" section in
http://wiki.squid-cache.org/Features/DynamicSslCert ?

if you need to intercept all https connections(seems to be your case) I
would suggest you to try use the 3.3 beta.

<SNIP>

Regards,
Eliezer

-- 
Eliezer Croitoru
https://www1.ngtech.co.il
IT consulting for Nonprofit organizations
eliezer <at> ngtech.co.il