This is pretty complex I use a separate VLAN that only gets the resources it needs for VPN but check your ACLs and if you really want to send VPN traffic into the proxy you need to force that traffic into the proxy NAT it

UPDATE 4-25-24 Added timeframes to secure web cache use Add this to the top of the config acl block_hours time 01:30-05:00 ssl_bump terminate all block_hours http_access deny all block_hours

@viragomann Yes, not sure why that made a difference but it's working.

follow this for use with creating a dstdom.broken file for use with pinned certificates.. https://wiki.squid-cache.org/SquidFaq/WindowsUpdate same item however add the office.com office.net domains into the folder so everything works and cache for updates still works acl BrokenButTrustedServers dstdomain "/usr/local/pkg/dstdom.broken" acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch sslproxy_cert_error deny all this works for me and all updates restored and office use

@viragomann Grazie , But my great difficulty is the English translation > ita which is often not very precise. I'm sorry if I made you angry it wasn't my intention. Thank you for your very important help for me.

@VMlabman Under Backend tab for the pfsense-01. you need to select a CA and select the client certificate that you have generated for your pfsense-01. Under Frontend tab under SSL offloading, select the ACME generated certificate under Certificate. Check if those settings fixes the issue you are having. Also I recommend watching the following youtube: How to Setup ACME, Let's Encrypt, and HAPRoxy in pfsense

@DBMandrake I also had a ticket open for this, it was closed as a duplicate I do know what you're talking about, iTunes does it also.

6.6 is active in 24 beta if anyone else wants to test it.

@lg1980 can you access the status page in squid 6.6? My system works but the status page says access denied