Good morning,
I have been using Squid as an http caching proxy for a long time.
It's the second time I configured Squid for https caching and
interception/inspection.
The first time everything was fine
The second...not so much.
I use the ssl_bump feature.
With Squid 4.13 and Openssl v 1.1.1k-1 all works well without errors or
warnings.
With Squid v. 5.2.1 and Openssl v. 3.0.1, I got one error and one
warning.
I tried to use the same squid.conf for Squid 4 and Squid 5.
Here are the problems with Squid 5.
1) ERROR
I checked the configuration with the command "squid -k parse" and I got
this error: ERROR: Unable to configure Ephemeral ECDH:
error:0480006C:PEM routines::no start line
If I remove the curve name from tls-dh in the config file, the error
disappears.
First question: Which is the problem? How can I do to keep the curve
name (prime256v1)
2) WARNING
I checked the configuration with the command "squid -k parse" and I got
this warning: WARNING: Failed to decode DH parameters
'/var/lib/squid/ssl_cert/squid-self-signed_dhparam.pem'
I generated the file for the Diffie-Hellman algorithm with this command
(it worked with Squid4): openssl dhparam -outform PEM -out
squid-self-signed_dhparam.pem 2048
Second question: Have you an idea on how to fix this?
Thank you.
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
