From: Christos Tsantilas Date: Wed, 18 Jul 2012 17:45:54 +0000 (+0300) Subject: author: Alex Rousskov , Christos Tsantilas , Christos Tsantilas SslBump: Support bump-ssl-server-first and mimic SSL server certificates. Summary: These changes allow Squid working in SslBump mode to peek at the origin server certificate and mimic peeked server certificate properties in the generated fake certificate, all prior to establishing a secure connection with the client: http://wiki.squid-cache.org/Features/BumpSslServerFirst http://wiki.squid-cache.org/Features/MimicSslServerCert The changes are required to bump intercepted SSL connections without excessive browser warnings. The changes allow to disable bumping of some intercepted SSL connections, forcing Squid to go into a TCP tunnel mode for those connections. The changes also empower end user to examine and either honor or bypass most origin SSL server certificate errors. Prior to these changes, the responsibility for ignoring certificate validation errors belonged exclusively to Squid, necessarily leaving users in the dark if errors are ignored/bypassed. Squid can still be configured to emulate old bump-ssl-client-first behavior. However, a manual revision of ssl_bump options is required during upgrade because ssl_bump no longer supports an implicit "negate the last one" rule (and it is risky to let Squid guess what the admin true intent was or mix old- and new-style rules). Finally, fake certificate generation has been significantly improved. The new code guarantees that all identically configured Squids receiving identical origin server certificates will generate identical fake certificates, even if those Squid instances are running on different hosts, at different times, and do not communicate with each other. Such stable, reproducible certificates are required for distributed, scalable, or fail-safe Squid deployment. Overall, the changes are meant to make SslBump more powerful and safer. The code has been tested in several independent labs. Specific major changes are highlighted below: Make bumping algorithm selectable using ACLs. Even though bump-server-first is an overall better method, bumping the client first is useful for backward compatibility and possibly for serving internal Squid objects (such as icons inside Squid error pages). The following example bumps special and most other requests only, using the old bump-client-first approach for the special requests only: ssl_bump client-first specialOnes ssl_bump server-first mostOthers ssl_bump none all It allow use the old ssl_bump syntax: ssl_bump allow/deny acl ... but warns the user to update squid configuration. Added sslproxy_cert_adapt squid.conf option to overwrite default mimicking behavior when generating SSL certificates. See squid.conf.documented. Added sslproxy_cert_sign squid.conf option to control how generated SSL certificates are signed. See squid.conf.documented. Added ssl::certHasExpired, ssl::certNotYetValid, ssl::certDomainMismatch, ssl::certUntrusted, and ssl::certSelfSign predefined ACLs to squid.conf. Do not require http[s]_port's key option to be set if cert option is given. The fixed behavior for bumped connections now matches squid.conf docs. Generate stable fake certificates by using signing and true certificate hashes as the serial number and by using the configured CA private key for all fake certificates. Use minimal, trusted certificate for serving SSL errors to the client instead of trying to mimic the broken true certificate (which results in double error for the user: browser error dialog plus Squid error page). To mimic "untrusted" true certificates, generate an untrusted CA certificate from the configured trusted CA certificate. This both reduces configuration effort (compared to a configuration option) and results in identical untrusted fake certificates given identical Squid configurations. Intelligent handling of CONNECT denials: Do not connect to origin servers unless CONNECT is successfully authenticated. Delay errors.Added sslproxy_cert_sign squid.conf option to control how generated SSL certificates are signed. See squid.conf.documented. Provide '%I' error page formatting code with enough information to avoid displaying '[unknown]' on SQUID_X509_V_ERR_DOMAIN_MISMATCH errors. Set logged status code (%