[Solved]squid, multi SSL reverse proxy

marcelloc

I had to fill in the 443 number in the ssl port to prevent it from looping to the admin interface. Odd but now everything seams to be okay…

Change admin interface to other then 80/443.

jjandrob

Hi,

I have done that.. but i have an issue where everything is defaulting to FQDN when using SSL.

Is there a way to use more then one FQDN with this for SSL?

non SSL is working fine…

marcelloc

@jjandrob:

Is there a way to use more then one FQDN with this for SSL?

IIRC, on squid as well on apache, you need on ip address for each ssl certificate.

A wildcard certificate is the way to workaround it. after ssl certificate check I think host header could be checked(on apache it does).

jjandrob

hi!

I have an ssl wild card cert in pfsense & it's configured to use that cert for the reverse proxy.

is there a fix? (the header check u referenced)

marcelloc

@jjandrob:

is there a fix? (the header check u referenced)

The ssl is the first step, after this, normal host header should work.

jjandrob

hi,

my fqn to my router is home.x.net

I'm trying to reverse two ssl's using my wildcard ssl.

currently my first ssl is working (home.x.net)

my second ssl is being matched to home.x.net even though I'm typing in termsrv01.x.net

watching the logs I'm seeing the entry coming in as home.x.net. I'm not sure where it's getting rewritten.

the way it's acting… I'm not sure if adding a different ip would help for regardless of what ssl traffic I'm sending... its matching against home.x.net.

jjandrob

I found the issue and sadly it's in the /usr/local/pkg/squid_reverse.inc.

The in file you have the following.

foreach (explode(",", $ifaces) as $i => $iface) {
                $real_ifaces[] = squid_get_real_interface_address($iface);
                if($real_ifaces[$i][0]) {
                      //HTTP
                      if (!empty($settings['reverse_http']))
                                $conf .= "http_port {$real_ifaces[$i][0]}:{$http_port} accel defaultsite={$http_defsite} vhost\n";
                      //HTTPS
                      if (!empty($settings['reverse_https']))
                                $conf .= "https_port {$real_ifaces[$i][0]}:{$https_port} accel cert={$reverse_crt} key={$reverse_key} defaultsite={$https_defsite}\n";
                        }
                }

Under HTTPS you need to add vhost\n at the very end. This is why http was working but NOT ssl. :-)

Please update the config file to read as follows.
$conf .= "https_port {$real_ifaces[$i][0]}:{$https_port} accel cert={$reverse_crt} key={$reverse_key} defaultsite={$https_defsite} vhost\n";

marcelloc

Thanks jjandrob. :) I've published version 2.0.5_5 with this fix.

jvorhees

Hello,

and thank you for the great work, reverse ssl is working well now !!!

I 've just a bug for xmlrpc syncing the reverse part of squid, only the normal proxy is synced with peer, not the reverse parts of the configuration. (Tested only on 2.0.1 amd64 with squid 2.0.5_5)

I'll check on i386, just in case ;)
EDIT: Same behaviour on 2.0.1 i386 / squid 2.0.5_5 :(

If you have any hint on that…

Thanks.

marcelloc

@jvorhees:

If you have any hint on that…

I've pushed a fix for it with no version change. Reinstall the package and test if it works.

jvorhees

Thank you Marcelloc !!! it's working well now ;)