I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump.
Now the problem is when I try to access any site, this shows a warning message that the certificate is not from a valid issuer, "sec_error_unknown_issuer". Moreover most browsers implement the HTTPS Strict (HSTS) so they won't let the sites open with the non-trusted certificate.
I purchased a server certificate and added this to the CA, but then Squid will not even start.
What should I do? Do I need to add the root certificate of the certifying authority, or I cannot bypass this warning message. For the SSL bumping all Squid needs to do is to behave as a server to the client and as a client to the server.
If it generates a certificate for a particular website on go then it is logically not possible.
My question is how to bypass this warning message on the client machine. I tried adding the certificates to the Firefox lists but this does not help due to HSTS.