SSL Man In the Middle Filtering blocking any app

reza3sw

I installed the internal Certificate and CA and installed it on the clients, and it works on the web (chrome firefox), but it does not work with any mobile application or any application that wants to connect to port 443 via IP. Encountered. I guess this problem does not arise because it does not recognize the IP. But what is the solution? How do you get this to squid?

Is this because mobile apps want to connect to the server via IP and MIMT prevents it? Or has it another reason?

mateusscheper

I'm having the same problem, but some PCs can't connect to some sites like https://trello.com.
On our Android devices, we can connect to apps like Snapchat, Whatsapp, etc, but we can't download audios, photos, etc.

reza3sw

This is a very big problem that I have been asking over and over again, but nobody could answer it. Perhaps this is a pfsense problem that could not solve it ... I had this problem with the https://trello.com site and it was a problem. I put in the bypass, but other apps can not be done
If we put all the programs in the bypass, then this pfsense part is not applicable ... This is still a problem, and it's a problem for administrators and those who can solve this problem. Please provide a solution.

Also, there are other problems, such as openconnect, in Linux and the ubuntu terminal with port 443, and even sites and applications that need access to the server through the IP do not work.

Generally speaking, when the pfsense and MITM proxy server is used, everything is cut off and users become very dissatisfied.

aGeekhere

https://forum.netgate.com/topic/100342/guide-to-filtering-web-content-http-and-https-with-pfsense-2-3/166

Read the last few comments

reza3sw

Thanks but
I set manualy proxy and port in android phone..but didn't work any app

And define rule in NAT port forward
80 and 443 redirect to pfsense lan address port 3128

But not work any app

Derelict

Many believe that HTTPS MITM is an unsound practice if not immoral. Personally, I am one of them.

When you click transparent proxy you automatically get a port forward on the squid interfaces that forwards all port 80 traffic to 3128.

If you also check HTTPS you also get a port forward for port 443 traffic to port 3129.

Those are the default ports.

If you set the clients manually you do not need port forwards and should disable transparent mode.

Everything you should need is here:

https://www.youtube.com/watch?v=xm_wEezrWf4

reza3sw

Thanks for your good answer ... The things you said are true, but the problem with Internet access is that the smartphone apps are still up to date with MITM...
But when I use MITM - splice all ...any app work correctly

I also believe that https MITM is not applicable ... but where need control bandwidth through squid...

Derelict

Splice all is not MITM.

reza3sw

... I mean, in Man in the middle, enable the splice all option, the problem is resolved, but the monitoring on 443 is not complete.

Derelict

This post is deleted!

reza3sw

I searched on other sites that are related to squid.
This problem has been reported by squid users but no solutions have been made

Has anyone had this problem? Has it resolved?

reggie14

Android apps, by default, don't trust roots installed by the user/admin. This security feature was added in Android N.

reza3sw

Thanks
There is no solution right now?

Gertjan

The MITM "problem" will probably never get solved.

reza3sw

@gertjan said in SSL Man In the Middle Filtering blocking any app:

The MITM "problem" will probably never get solved.

Thank you very much