Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid 3.3.4 package for pfsense with ssl filtering

    Scheduled Pinned Locked Moved Cache/Proxy
    305 Posts 72 Posters 329.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • perikoP
      periko
      last edited by

      Don't know if this helps, but if u run ccleaner to clear cache in all your browsers before testing, does this helps?

      Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
      www.bajaopensolutions.com
      https://www.facebook.com/BajaOpenSolutions
      Quieres aprender PfSense, visita mi canal de youtube:
      https://www.youtube.com/c/PedroMorenoBOS

      1 Reply Last reply Reply Quote 0
      • E
        exograpix
        last edited by

        Squid ssl filtering not working, it used to work 3 days back, but now certificate error are popping all over. please suggest.

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          You have to import pfsense-ca crt on firefox too, internet explorer and chrome uses certmgr.msc imported cert.

          I'm testing it a lot without any cert issues on any sites.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • E
            exograpix
            last edited by

            Hi,

            I have loaded ca certificate in trusted root certificate and webconfigurator certificate in personal (through certmgr.msc). but still shows certificate error in internet explorer. please suggest what to do.

            1 Reply Last reply Reply Quote 0
            • E
              exograpix
              last edited by

              In spite of all my effort still certificate error as soon as I enable ssl filtering , help guys.

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                @exograpix:

                I have loaded ca certificate in trusted root certificate and webconfigurator certificate in personal (through certmgr.msc). but still shows certificate error in internet explorer. please suggest what to do.

                the only place you need is trusted root certificate on ie and firefox.

                Sure it works.

                screenshot the certificate you get when firefox rejects.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • P
                  postduif
                  last edited by

                  @marcelloc:

                  @exograpix:

                  I have loaded ca certificate in trusted root certificate and webconfigurator certificate in personal (through certmgr.msc). but still shows certificate error in internet explorer. please suggest what to do.

                  the only place you need is trusted root certificate on ie and firefox.

                  Sure it works.

                  screenshot the certificate you get when firefox rejects.

                  It doesn't work any longer since I've updated to pfSense 2.1.1
                  It worked on 2.1

                  1 Reply Last reply Reply Quote 0
                  • E
                    exograpix
                    last edited by

                    Thats my problem too , I have tried all combination but doesn't work, it used to work earlier quite smoothly, but somehow it stopped working now.

                    I request to sort this issue out asap to help the community and existing installs.

                    1 Reply Last reply Reply Quote 0
                    • belleraB
                      bellera
                      last edited by

                      @postduif:

                      It doesn't work any longer since I've updated to pfSense 2.1.1
                      It worked on 2.1

                      Need to see which system things changed with the upgrade.

                      Verify the "orphan" libraries for squid3-dev and what about OpenSSL?

                      OpenSSL does not like country codes longer than two letters, so remove entries that are not actually country codes

                      https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes

                      1 Reply Last reply Reply Quote 0
                      • E
                        exograpix
                        last edited by

                        I have used the standard process as pfsense 2.1 (now even in previous version ssl certificate error is popping)

                        I installed pfsense.

                        Created the internal CA.

                        Created the server certificate (tried client too)

                        Import CA certificate through certmgr.msc in trusted root

                        Import other certificate in personal

                        copied missing files for squid.

                        Installed squid-dev from packages.

                        Configured squid as before with ssl filter and certificate and boom even microsoft default certificate error.

                        1 Reply Last reply Reply Quote 0
                        • P
                          postduif
                          last edited by

                          @bellera:

                          @postduif:

                          It doesn't work any longer since I've updated to pfSense 2.1.1
                          It worked on 2.1

                          Need to see which system things changed with the upgrade.

                          Verify the "orphan" libraries for squid3-dev and what about OpenSSL?

                          OpenSSL does not like country codes longer than two letters, so remove entries that are not actually country codes

                          https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes

                          Checked, and the orphan libraries are on the system. Countrycode is 2 letters.
                          Squid http filtering works fine, only the https part results in certificate errors.

                          1 Reply Last reply Reply Quote 0
                          • E
                            exograpix
                            last edited by

                            https is the problem and it is major concern now.

                            1 Reply Last reply Reply Quote 0
                            • belleraB
                              bellera
                              last edited by

                              pfSense 2.1 (not upgraded to 2.1.1)
                              squid3-dev upgraded from 3.3.10 pkg 2.2.1 to 3.3.10 pkg 2.2.2

                              Bug for interception

                              Last lines of squid.conf generated by 2.2.1

                              # Custom options
                              
                              always_direct allow all
                              ssl_bump server-first all
                              # Setup allowed acls
                              # Allow local network(s) on interface(s)
                              http_access allow localnet
                              # Default block all to be sure
                              http_access deny allsrc
                              

                              Last lines of squid.conf generated by 2.2.2

                              # Custom options before auth
                              
                              # Setup allowed acls
                              # Allow local network(s) on interface(s)
                              http_access allow localnet
                              # Default block all to be sure
                              http_access deny allsrc
                              

                              Workaround until next version

                              Put at Custom ACLS (Before_Auth) box the lines

                              always_direct allow all
                              ssl_bump server-first all

                              Custom ACLS (After_Auth)

                              In addition to this, the box Custom ACLS (After_Auth) does nothing.

                              Rotate Cron duplicated

                              The upgrade also duplicates the rotate cron. You can see it if you have Cron package installed

                              0  	0  	*  	*  	*  	root  	/bin/rm /var/squid/cache/swap.state; /usr/pbi/squid-i386/sbin/squid -k rotate -f /usr/pbi/squid-i386/etc/squid/squid.conf  	
                              0  	0  	*  	*  	*  	root  	/usr/pbi/squid-i386/sbin/squid -k rotate -f /usr/pbi/squid-i386/etc/squid/squid.conf
                              

                              Delete the old cron containing rm swap.state and look up the new option Proxy server: Cache management: Clear cache on log rotate

                              Discussion about the new option, https://forum.pfsense.org/index.php?topic=74453.msg407287#msg407287

                              More about squid duplicated cron, https://forum.pfsense.org/index.php?topic=74633.0

                              1 Reply Last reply Reply Quote 0
                              • E
                                exograpix
                                last edited by

                                Thanks for all the support, worked like a charm, much relieved now, I am not blaming developer doing very good job, but this bug wasted almost two days of working time.

                                Again my appreciations , you are a life saver.

                                If you can, please explain cron thing in details.

                                1 Reply Last reply Reply Quote 0
                                • belleraB
                                  bellera
                                  last edited by

                                  Thanks for your good words!

                                  @exograpix:

                                  If you can, please explain cron thing in details.

                                  https://forum.pfsense.org/index.php?topic=74453.msg407820#msg407820

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    bardok
                                    last edited by

                                    I just created an account to say thank you. I've wasted all my afternoon after the upgrade, trying to guess why ssl bumping stopped to work at our school, but tomorrow everything (included the filter for the students) will be able to continue as expected.

                                    1 Reply Last reply Reply Quote 0
                                    • belleraB
                                      bellera
                                      last edited by

                                      Thanks for your good words!

                                      Also, at school, www.bellera.cat  :) :) :) :)

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        ssl_bump acls were inside auth loop. I'm fixing it right now.

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • E
                                          exograpix
                                          last edited by

                                          Hi,

                                          Thanks for update regarding squid fixing, please look into icap issue too, somehow not able to successfully run squid after clam update.

                                          Thanks in advance

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @exograpix:

                                            Hi,

                                            Thanks for update regarding squid fixing, please look into icap issue too, somehow not able to successfully run squid after clam update.

                                            Thanks in advance

                                            This is still under devel. Current feedback says that's only working on i386 version.

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.