Project

General

Profile

Actions
Copy link

Bug #6527

closed

Squid 3.5 - Deprecated "ssl_bump server-first all" don't allow SNI in transparent mode with HTTPS/SSL Interception

Added by Michael Epstein over 8 years ago. Updated almost 8 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Squid
Target version:
pfSense - 2.4.0
Start date:
06/23/2016
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
All
Affected Plus Version:
Affected Architecture:

Description

As described in the squid wiki, "ssl_bump server-first all" is deprecated in squid 3.5+

http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit#Squid_Configuration_File

For proper SNI detection you most use for example:

acl step1 at_step SslBump1

ssl_bump peek step1
ssl_bump bump all

I test this configuration in "Custom ACLS (Before Auth)" with Squid 3.5, transparent mode on and HTTPS/SSL Interception on and everything is working great. With "ssl_bump server-first all" SNI isn't working.

Actions
Copy link

Also available in: Atom PDF