Tried the two links provided, still no luck.
details:
squid -v
Squid Cache: Version 3.4.11
configure options: '--disable-strict-error-checking'
'--disable-arch-native' '--enable-shared'
'--datadir=/usr/local/share/squid'
'--libexecdir=/usr/local/libexec/squid' '--disable-loadable-modules'
'--enable-arp-acl' '--enable-auth' '--enable-delay-pools'
'--enable-follow-x-forwarded-for' '--enable-forw-via-db'
'--enable-http-violations' '--enable-icap-client' '--enable-ipv6'
'--enable-referer-log' '--enable-removal-policies=lru heap'
'--enable-ssl' '--with-openssl' '--enable-storeio=aufs ufs diskd'
'--with-default-user=_squid' '--with-filedescriptors=8192'
'--with-krb5-config=no' '--with-pidfile=/var/run/squid.pid'
'--with-pthreads' '--with-swapdir=/var/squid/cache'
'--disable-pf-transparent' '--enable-ipfw-transparent'
'--enable-external-acl-helpers=LDAP_group SQL_session file_userip
time_quota session unix_group wbinfo_group LDAP_group
eDirectory_userip' '--prefix=/usr/local' '--sysconfdir=/etc/squid'
'--mandir=/usr/local/man' '--infodir=/usr/local/info'
'--localstatedir=/var/squid' '--disable-silent-rules' 'CC=cc'
'CFLAGS=-O2 -pipe' 'LDFLAGS=-L/usr/local/lib'
'CPPFLAGS=-I/usr/local/include' 'CXX=c++' 'CXXFLAGS=-O2 -pipe'
'--enable-ssl-crtd' --enable-ltdl-convenience
tail -10 squid.conf
https_port 3127 intercept ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=16MB cert=/etc/squid/ssl_cert/server1.crt
sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s
/usr/local/squid/var/lib/ssl_db -M 16MB
sslcrtd_children 10
ssl_bump server-first all
cert generation
openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
openssl rsa -passin pass:x -in server.pass.key -out server.key
rm server.pass.key
openssl req -new -key server.key -out server.csr
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 730 -in server.csr -signkey server.key
openssl x509 -req -days 730 -in server.csr -signkey server.key -out
server.crt
cat server.key server.crt > server1.crt
squid -z
FATAL: No valid signing SSL certificate configured for https_port
0.0.0.0:3127
Squid Cache (Version 3.4.11): Terminated abnormally.
CPU Usage: 0.080 seconds = 0.060 user + 0.020 sys
Maximum Resident Size: 6752 KB
Page faults with physical i/o: 0
cert generation ala
http://wiki.squid-cache.org/EliezerCroitoru/Drafts/SSLBUMP (squid.conf
changed to cert=/etc/squid/ssl_cert/myCA.pem)
openssl req -new -newkey rsa:1024 -days 365 -nodes -x509 -keyout
myCA.pem -out myCA.pem
squid -z
FATAL: No valid signing SSL certificate configured for https_port [::]:3127
Squid Cache (Version 3.4.11): Terminated abnormally.
CPU Usage: 0.040 seconds = 0.010 user + 0.030 sys
Maximum Resident Size: 6288 KB
Page faults with physical i/o: 0
In Reply To:
Hey Alan,
What is the full output of "squid -v"?
I am unsure about the akadia tutorial.
Please take a look at:
http://wiki.squid-cache.org/EliezerCroitoru/Drafts/SSLBUMP
It contains some hints on how to create the certificate and contains a
snippet of squid configuration to make a basic ssl-bump work(the echo
command code might not be right)
I am pretty sure the certificate you have created is not the right type
for the task.
Eliezer
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
In reply to:
On 2/15/2015 4:49 PM, Eliezer Croitoru wrote:
On 15/02/2015 23:36, Alan Palmer wrote:
I'm trying to get squid 3.4.11 on openbsd 5.6 to act as a transparent
ssl proxy.
I've rebuilt squid with --enable-ssl-crtd, generated my own self signed
cert (ala http://www.akadia.com/services/ssh_test_certificate.html) and
have the following config lines:
Hey Alan,
What is the full output of "squid -v"?
I am unsure about the akadia tutorial.
Please take a look at:
http://wiki.squid-cache.org/EliezerCroitoru/Drafts/SSLBUMP
It contains some hints on how to create the certificate and contains a
snippet of squid configuration to make a basic ssl-bump work(the echo
command code might not be right)
I am pretty sure the certificate you have created is not the right
type for the task.
Eliezer
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
