3

I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump.

Now the problem is when I try to access any site, this shows a warning message that the certificate is not from a valid issuer, "sec_error_unknown_issuer". Moreover most browsers implement the HTTPS Strict (HSTS) so they won't let the sites open with the non-trusted certificate.

I purchased a server certificate and added this to the CA, but then Squid will not even start.

What should I do? Do I need to add the root certificate of the certifying authority, or I cannot bypass this warning message. For the SSL bumping all Squid needs to do is to behave as a server to the client and as a client to the server.
If it generates a certificate for a particular website on go then it is logically not possible.

My question is how to bypass this warning message on the client machine. I tried adding the certificates to the Firefox lists but this does not help due to HSTS.

Improve this question
1
  • one way to implement this is to add the personal ca certificate to the every client machine but there are many paid firewalls like cyberoem which are capable of doing content filtering but they do not generate any certificate warning how they implement that. do they have their own certification authority. or i am mistaken somewhere.
    – shiv garg
    Commented Jun 22, 2015 at 13:44

1 Answer 1

Reset to default
2

You need to add the generated CA certificate to your browser as squid is performing MITM on your https connections.

Improve this answer
8
  • but what about https strict. i can not open gmail etc site. chrome will not even let the google to get opened
    – shiv garg
    Commented Jun 22, 2015 at 13:19
  • hsts is just telling your browser not to try accessing the website in http. Your browser will try directly https but as you will have your SQUID CA trusted, it will work.
    – r00t
    Commented Jun 22, 2015 at 13:21
  • so if i add the ca certificate to the trusted certificates then all sites should open
    – shiv garg
    Commented Jun 22, 2015 at 13:25
  • Yes exactly, just add the CA certificate to all your client browsers and it should work.
    – r00t
    Commented Jun 22, 2015 at 13:28
  • i am agreed with your comment. but there are many firewalls which do https filtering especially content filtering (like cybereom mime type filtering). do they have their own certification authority or how do they implement it. we dont get any certification error using cyberoem firewall
    – shiv garg
    Commented Jun 22, 2015 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .