Pfsense 2.2.2 + squid3 transparent HTTP/HTTPS proxy "Facebook partially loading"
-
No shit. Browsers do not trust MITM certificates by default? Shocking news!
That's not his problem. His browser trusts his "attack" cert perfectly fine. The PFSense OS doesn't trust the akamaihd.net cert.
I'm too lazy to dig into what certs PFSense trusts, but likely akamiahd is using a Certificate Authority not trusted by PFSense. I'm not sure what PFSense's policy is on keeping the root certs up to date, but changes are made to that list all the time. You should be able to obtain that root cert and add it into your trusted store yourself.
-
Good Night Guys,
I´m the same problem, but using only transparent´s squid work normally facebook according to the pictures below "see the options Remote Cert Checks are do not verify remote certificate" When allow the options in Remote Cert Checks: do not verify remote Certificate. But When to allow options in Remote Cert Checks: Accept remote server certificate Errors open only misconfigured pages and other don´t load.
When I do integrated with squid-guard , load for me this error in browser (ssl_error_rx_record_too_long) according to the last pictures below.
-
The problem with akamaidhd.net still persists as today. Has someone found a good solution? I've disabled SSL interception on my SquidProxy, but it would be good to turn it on again in near future.
-
Just a suggestion…
What if you whitelist fb in the proxy filter, and instead make blocking/ limiting rules in firewall based on fb's IPs? It will be quite long list of IPs, but you can make an alias and work with it.
-
same problem :'(
-
@JuniorAndrade:
same problem :'(
Its simple, you should selected "Do not verify remote cert" on the webgui proxy server.
-
@91X:
Its simple, you should selected "Do not verify remote cert" on the webgui proxy server.
Issue might not be with the remote certificate but the one generated at proxy level that is not signed by trusted CA. Such control, if any, depends on remote side.
Frankly I'm not using such MITM feature that I perceive as a way of twisting the HTTPS concept but if implementing such stuff is totally mandatory for you, why not using at proxy level certificate signed by well known CA? This should solve the issue, as far as I understand 8)
Not verifying remote cert in proxy server webgui means that proxy doesn't check is remote web server is using trusted certificate. I'll be surprised if either facebook or CDN do not rely on such private certs or certificates signed with CA not in pfSense "trusted CA" repository but why not… ??? To be checked.
-
Sorry to revive an old thread, but I too am having the exact same issue with pfSense 2.2.5 (Squid3 - 0.4.2 - 3.4 branch). I noticed the problem is happening to me even when I turn the transparent mode off and manually connect to the proxy as well.
Has anyone found a solution other than the "do not verify" option that has been mentioned? That doesn't seem like a safe solution given that I can't use that option only for Facebook.
-
If you're running in explicit mode then you should not have any of the SSL Interception stuff enabled. It's only for transparent mode.
-
@KOM:
If you're running in explicit mode then you should not have any of the SSL Interception stuff enabled. It's only for transparent mode.
If you don't mind, I'm not 100% in line with this statement :-\
Not discussing about the "is it acceptable to deploy MITM or not?" debate, once you decide to go for this, it may help for both explicit and transparent proxy design, as far a I understand. It will help much more with transparent proxy, I do agree but what MITM will bring is, even for explicit proxy, capability to analyse HTTP content, e.g. with anti-virus.
Without MITM, explicit proxy is only able to control CONNECT and therefore decide if access to given URL is authorized (e.g. Squidguard) but content is encrypted.
With MITM enabled, you have 2 different connections with Squid in the middle, able to look at content.Am I correct? ???
-
My understanding was that the proxies act in exactly the same way where content is concerned, regardless of mode.
-
I'm running in transparent mode - not explicit mode. So no one has a solution for this problem? I hate to give up on pfSense but unless I get a solution I may have no other choice . . .
-
I have seen cases where squid will return incomplete pages with HTTPS sites. One possible solution was to prioritize IP4 when doing DNS lookups. Go to your squid settings and check the Resolve DNS IPv4 First box and see if that makes any difference for you. Other than that, I highly recommend not using Transparent mode ever.
-
Same Problem!!
Dear lord, is pfsense getting worst with every version?? now https doesnt work with proxy….. traffic shapping doesnt work with XENSERVER, etc.
What's wrong Pfsense?? this are basic stuff!! come on!!
-
Same Problem!!
Dear lord, is pfsense getting worst with every version?? now https doesnt work with proxy….. traffic shapping doesnt work with XENSERVER, etc.
What's wrong Pfsense?? this are basic stuff!! come on!!
yeah ::)
