[squid-users] cache_peer: Squid did not use certificate defined in the the cache_peer

From: David Touzeau <david_at_articatech.com>
Date: Mon, 27 May 2013 15:13:09 +0200

Dear i have setup a local apache that listens on 82 port
Squid is on reverse proxy mode and listen both 443, 80

The Apache is set in virtualhost mode.

When connecting to the virtual host called upadm.domain.com:443, the
certificate sended by SQUID is the default certificate and not the
certificate /etc/squid3/upadm.domain.com.crt
What i missed ???

Best regards

http_port 0.0.0.0:80 accel vhost vport
https_port 443 accel cert=/etc/squid3/ssl/cacert.pem
key=/etc/squid3/ssl/privkey.pem vhost vport

cache_peer 127.0.0.1 parent 82 0 name=update-articatech-com no-query
originserver login=PASS
cache_peer 127.0.0.1 parent 82 0 front-end-https=on
name=ssl_update-domain-com no-query originserver login=PASS
cache_peer 127.0.0.1 parent 82 0 name=upadm-articatech-com no-query
originserver login=PASS
cache_peer 127.0.0.1 parent 82 0 front-end-https=on
sslcert=/etc/squid3/upadm.domain.com.crt
sslkey=/etc/squid3/upadm.domain.com.key name=ssl_upadm-articatech-com
no-query originserver login=PASS

# ACLs definitions...
acl CONNECTREV localport 443
acl DomFor0 dstdomain update.domain.com
acl DomFor0 dstdomain upadm.domain.com

# Peer domains definitions...

# Peer access definitions...
cache_peer_access update-domain-com allow !CONNECTREV DomFor0
cache_peer_access ssl_update-domain-com allow CONNECTREV DomFor0
cache_peer_access upadm-domain-com allow !CONNECTREV DomFor0
cache_peer_access ssl_upadm-domain-com allow CONNECTREV DomFor0
cache_peer_access deny all

# do not try to browse outside the peer
never_direct allow !CONNECTREV DomFor0
never_direct allow CONNECTREV DomFor0
miss_access allow !CONNECTREV DomFor0
miss_access allow CONNECTREV DomFor0

# Allow Access definitions
http_access allow !CONNECTREV DomFor0
http_access allow CONNECTREV DomFor0

# Other definitions for reverse mode
ssl_unclean_shutdown on
##############################################
Received on Mon May 27 2013 - 13:13:19 MDT

This archive was generated by hypermail 2.2.0 : Mon May 27 2013 - 12:00:07 MDT