3 ms·
You can still do that with HTTPS. Squid supports HTTPS proxying. Basically, you create your own root CA, distribute it to all endpoints on your network, and use
by pfg 11y ago
You can still do that with HTTPS. Squid supports HTTPS proxying. Basically, you create your own root CA, distribute it to all endpoints on your network, and use squid to MITM all connections. That's (essentially) how most corporate proxies work.
- esaym 11y agoYes, I'll be setting that up soon. But if the cert is truly bad from the website, there doesn't seem to really be an easy way to check it since squid either outright accepts it or just rejects it depending on the config.
- kijin 11y agoIf Squid can't proxy sites with bad certs in a reasonable way, that's Squid's problem, not a problem with HTTPS. The fact that some open-source software can't do what you want it to do doesn't mean that there's anything wrong with other people trying to be secure. The most obvious solution would be to fix Squid, pay someone to fix it if you can't, or at the very least write a bug report to let other people know that you need it fixed.
- phaemon 11y agoIt appears Squid can do this. See: http://wiki.squid-cache.org/Features/MimicSslServerCert http://wiki.squid-cache.org/Features/MimicSslServerCert