Re: Redirect HTTPS with Squid3+Squidguard
Michael I. <linux-michael-i@abwesend.de> wrote:
> But I have a new problem, I want to have a transparent proxy for http
> this works fine but when I add the iptables rule for https the loading
> won't work.
Of course not. That this is not working is the _whole point_ of any
end-to-end encrypted connection.
What you are effectivly trying to do is an Man-in-the-Middle "attack".
You cannot transparently proxy *any* encrypted connection without major
trickery, like I wrote in my first mail. You would need a fake CA
certificate (why this is a _very_ bad idea you just have to look at the
latest CNNIC and MSC debacle: (sorry, German URL)
<https://www.psw-group.de/blog/cnnic-signiert-falsche-google-zertifikate/2112>
or
<http://www.heise.de/security/meldung/Google-deckt-erneut-Missbrauch-im-SSL-Zertifizierungssystem-auf-2583414.html>), and have your proxy terminate the end-to-end encryption by issuing a fake certificate on the fly, so that the client is satisfied and then create another new encrypted connection to the intended end-point.
There _are_ security appliances out there which work in that way but
they are considered _very_ *very* bad practice and should be avoided at
all costs.
Grüße,
Sven.
--
Sigmentation fault. Core dumped.
Reply to: