Contents
Can a Squid proxy intercept a HTTPS connection?
In most situations though, intercepting direct HTTPS connections will not work and is pointless because Squid cannot do anything with the encrypted traffic — Squid is not a TCP-level proxy. WARNING: HTTPS was designed to give users an expectation of privacy and security.
Can a proxy server validate a destenation certificate?
The HTTP proxy server does not see everything and does not validate destenation servers certificate whatsoever. There can be some confusion with this whole http, https, proxy thing. It is possible to connect to a HTTP proxy with https. In this case, the communication between the client and the proxy is encrypted.
Is it possible to connect to HTTP proxy with https?
It is possible to connect to a HTTP proxy with https. In this case, the communication between the client and the proxy is encrypted. There are also so called TLS terminating or interception proxy servers like Squid’s SSL Peek and Splice or burp, which see everything .
Can a Squid proxy be used as an atomic bomb?
Attack tools are an equivalent of an atomic bomb in real world: Make sure you understand what you are doing and that your decision makers have enough information to make wise choices. Squid SslBump and associated features can be used to decrypt HTTPS CONNECT tunnels while they pass through a Squid proxy.
When does squid not know about the connection?
Direct SSL/TLS connection. When a browser creates a direct secure connection with an origin server, there are no HTTP CONNECT requests. The first HTTP request sent on such a connection is already encrypted. In most cases, Squid is out of the loop: Squid knows nothing about that connection and cannot block or proxy that traffic.
Can a squid 2.5 terminate a TLS connection?
Squid-2.5 and later can terminate TLS or SSL connections. You must have built with –enable-ssl. See https_port for more information. Squid-3.5 and later autodetect the availability of GnuTLS library and enable the functionality if available.
When does a browser create a direct SSL / TLS connection?
Direct SSL/TLS connection. When a browser creates a direct secure connection with an origin server, there are no HTTP CONNECT requests. The first HTTP request sent on such a connection is already encrypted.