3

I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump.

Now the problem is when I try to access any site, this shows a warning message that the certificate is not from a valid issuer, "sec_error_unknown_issuer". Moreover most browsers implement the HTTPS Strict (HSTS) so they won't let the sites open with the non-trusted certificate.

I purchased a server certificate and added this to the CA, but then Squid will not even start.

What should I do? Do I need to add the root certificate of the certifying authority, or I cannot bypass this warning message. For the SSL bumping all Squid needs to do is to behave as a server to the client and as a client to the server.
If it generates a certificate for a particular website on go then it is logically not possible.

My question is how to bypass this warning message on the client machine. I tried adding the certificates to the Firefox lists but this does not help due to HSTS.

  • one way to implement this is to add the personal ca certificate to the every client machine but there are many paid firewalls like cyberoem which are capable of doing content filtering but they do not generate any certificate warning how they implement that. do they have their own certification authority. or i am mistaken somewhere. – shiv garg Jun 22 '15 at 13:44
2

You need to add the generated CA certificate to your browser as squid is performing MITM on your https connections.

  • but what about https strict. i can not open gmail etc site. chrome will not even let the google to get opened – shiv garg Jun 22 '15 at 13:19
  • hsts is just telling your browser not to try accessing the website in http. Your browser will try directly https but as you will have your SQUID CA trusted, it will work. – r00t Jun 22 '15 at 13:21
  • so if i add the ca certificate to the trusted certificates then all sites should open – shiv garg Jun 22 '15 at 13:25
  • Yes exactly, just add the CA certificate to all your client browsers and it should work. – r00t Jun 22 '15 at 13:28
  • i am agreed with your comment. but there are many firewalls which do https filtering especially content filtering (like cybereom mime type filtering). do they have their own certification authority or how do they implement it. we dont get any certification error using cyberoem firewall – shiv garg Jun 22 '15 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.