Https filtering - iTunes, iPhones?

[uncleaelfrich]

I have implemented the https filtering tutorial as found here https://docs.diladele.com/tutorials/filtering_https_traffic_squid_pfsense/

I have gotten everything to work EXCEPT for itunes, icloud, and my iphones and ipad.

I have tried the iphones both with and without putting the proxy in the general settings for the wifi. I have added the websites for iOS, macOS, etc. that apple gives. https://support.apple.com/en-us/HT201999 But I am still unable to reach the iTunes store or to update any apps on our iphones.

I am sure I am not the first person to experience this problem, but I haven’t been able to find any solutions online. Can anyone please help me with this problem?

Thanks.

[sichent]

The apple products (and most mobile ones) use so called SSL pinning when application refuses to accept any other HTTPS certificate except the one known to it,
See https://docs.diladele.com/faq/squid/sslbump_exlusions/apple_app_store.html

Hope it helps.
(here in the test lab I had to add .mzstatic to make the iTunes work though proxy).

[uncleaelfrich]

I found that adding

apple.com
icloud.com
mzstatic.com

to the whitelist at Services>Squid Proxy Server>ACLs seems to work for me (in addition to the FAQ from diladele from sichent above, if you are using the Diladele Web Safety.)