Squid + https

[DaddyGo]

@techtester-m said in Squid + https:

but I'll search for some good lists for pfBlockerNG and see.

in the "devel" version have a lot of built-in lists, but I also have a lot of collected lists

don't be fooled by the word = DEVEL - this current / actual version

[Gertjan]

@techtester-m said in Squid + https:

Do any of you know how does a certificate validation works exactly, in technical details?

Yep.
Have a look at least 10 videos from this list https://www.youtube.com/results?search_query=https+certificate+how+it+works

Added to that :
In a perfect world, DNS is non spoofable (because you use the Resolver and DNSSEC ;) ), your app will know for sure what the real IP of a site is.

The important things :
In a certificate, you find the dates of validity,
The CA, used to certify that the certicate is valid. An OS, web browser, app, whatever, sues a build in list with known trusted CA's - and take note : you can add your own CA .... you can become a CA for your own network.
In a certificate is embedded the domain name or even a root domain name :

[techtester-m]

@Gertjan @DaddyGo I already knew about the certificate itself and I myself have signed or got signed by a trusted one etc. All I wanted to know is the security mechanism(s) that prevent MITM. Yesterday I did more reading on the subject and on digital signatures as well and understood everything I wanted to understand and know. It took a few hours over 1-2 days but Hopefully it'll be stored in my head forever haha

As I understand it - Unless a MITM got the end user to trust his CA, the attack will fail.

It would fail because:

(A) MITM would try and send his own PK and the browser will give warning.
(B) MITM must send his own PubK in order to encrypt/decrypt the content with his Private Key which is the key to everything here basically.
(C) If MITM changes anything in the message that comes with the certificate, like the domain name etc. the signature verifying algorithm would fail and the browser will give warning.
(D) No CA would sign fraudulent certificate unless they wanna go bankrupt and get sued.
(E) Even if a MITM sends the end user the exact same certificate he himself got from let's say Google then the browser might think for the first time that it's talking to Google but the next communication would fail because it would be encrypted with Google's PubK and could be decrypted only with Google's Private-Key so the MITM won't be able to read anything, there will be a connection time out and the attack would fail.
(F) I'm sure there are few more reasons...

Thank you guys for all your help, input and knowledge. A pleasure as always :)

[viberua]

Hello,
Can you help me find solution?
I've added CA of our domain controller in System > Cert Manager

But in squid SSL MITM i can't select this CA and enable SSL filtering. Only "None" can select.

How i can set up domain CA for enabling SSL filtering ?
Or pfsense can only accept self made cert from internal CA?
Thanks in advance.

[techtester-m]

@viberua I'm no expert at all on the matter but it tells you to create your own on pfSense, because it needs to be able to create certs on demand and locally...I think, but again..no expert.

[Gertjan]

Never used squid before, but I guess a CA should be created first.
Here :

Then, based on the CA, you create your certs :

These certs can be used in OpenVPN, FreeRadius, the pfSense GUI, etc.
CA's can't be use directly, except for signing (your own) certs.

[DaddyGo]

@Gertjan said in Squid + https:

Never used squid before, but I guess a CA should be created first.
Here :

exactly,
use the pfSense certificate builder and then it will appear in Squid settings

then you can also export it for installation on external devices

like:

[viberua]

@DaddyGo so if i don't want create new CA because i already have one, then i can't use this external CA cert in MITM?

[DaddyGo]

@viberua

Squid works with an internal intermediate certificate
you can't use example Lets' E or other

because of what is described above in this thread......

like:

[techtester-m]

@viberua You need to "become" a CA (a local one of course) and have your own Public Key & Private Key in order for Squid to encrypt-decrypt.

[viberua]

@DaddyGo when i try to create an intermediate CA, the list of signing CA is empty
but as i said i have our domain CA server and added his CA cert to CA settings

[techtester-m]

@viberua said in Squid + https:

but as i said i have our domain CA server and added his CA

Won't work.

Do this from scratch:

And this is what you should see:

[DaddyGo]

@viberua

you are doing something wrong...
because it works very well in pfSense

just watch squidSSL2 I just created for the sake of the test...

[DaddyGo]

@techtester-m

I like you bro, but it is not appropriate to speak into an ongoing conversation...

forum etiquette

[techtester-m]

@DaddyGo
Ok...I just saw notifications of his questions jump in my email so it caught my attention and just wanted to help.
But I accept your point. Have a great one :), I'm out. No expert anyway lol

[DaddyGo]

@techtester-m

nothing happened...
we taught you about these a few days ago
I'm glad, you learned

[Gertjan]

@viberua

Your image :

This is mine :

More in detail :
You :

Me :

What is your pfSense version or what ?

[DaddyGo]

@Gertjan said in Squid + https:

What is your pfSense version or what ?

legitimate question anyway

[Abdou Ahmed]

@DaddyGo
Hi
how are you . i just want to ask if i can use pfsense proxy with mikrotik server
clearly . i wannot to add a certificat in users phone . just add it in mikrotik
to Enable SSL filtering in my network
i tray to that alot and have no result

[DaddyGo]

@Abdou-Ahmed said in Squid + https:

just add it in mikrotik

well, please specify this, please what kind of Mikrotik???
I'm pretty prepared in the "picture" - Mikrotik...
(all our CATV traffic is provided by Mikrotik devices)