@karimhaydar31 said in connection is not private when using Chrome:

X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN

The certificate is valid, but not co-signed by one of the major players, like Verisign etc. see here for a list.

The thing is, your browser only accepts (and stays silent) certificates if they were co or toot signed by one of the authorities that are on 'the list' (in your device).
You could actually empty this list, and your browser would not even trust https://www.micirostf.com any more.

So, the easiest thing to do, is : export the certificate that is being used by the Webconfigurator, and import it into you browser / OS.
Now, your browser / OS it trust it, and no more errors. That's all it takes !

You could also get your hands on a certificate that is trusted out of the box.
A trusted certificate is free.
Example : if these are your general settings :

5f251b0a-5c89-4ab6-aec6-556829c21c72-image.png

and you actually own, or rent the some-domain.tld domain name, you could obtain certificate for *.some-domain.tld for free.
The pfSense package "acme" is all about that functionality.
Again : the certificate will be free, the domain name will cost some money.

@ma0f97 Has no one an idea?

Coloca ele no Bypass Proxy for These Destination, e libera porta.

@anderson-soprana valeu aqui deu certo.

@lucasll había puesto el IP y puerto del kerio en Advanced - Miscellaneus del pfsense pero ya encontré la solución. Mi DNS superior no resolvía las direcciones fuera de la VPN. Utilicé un repositorio alternativo que el DNS era capaz de resolver.

@norcarde A transparent proxy would solve your application problems, but they are a hassle to setup and can introduce their own problems.

@santi buen día. Ya revisé el log. Dónde obtuve la ip a la cual de está conectado, la agregue a la lista blanca, además, del puerto. Pero sigue sin funcionar .

@mhmz

does it make any sense sitting on proxy server with deactivated aes-ni ?

Take a good look at what's getting blocked in your log files, it's easy to break google products because of their spyware/tracking integration.

@aGeekhere said in squid blocking things I want to access (access denied for inter-LAN devices):

you can get the refresh patten here https://github.com/mmd123/squid-cache-dynamic_refresh-list/pulls

I know, I'm the one that made that repo xD

No, the problem is I forgot it needs to be run in custom MITM mode to actually work with caching things properly, and by the time I realized that last night it was like 2am, so I went to sleep, I'll be back to work on it later today @aGeekhere

As soon as you have access to the full, decrypted data stream it's most probably possible to cache everything.

But :
The, for example, ccs style sheet file, can have a unique name - and won't be re used ever again, so it will get reloaded anyway.
The file creation date can be set to 'now' so the browser will request a fresh copy, even if the content didn't change at all.
etc etc .

@High_Voltage said in Web gui, ssl/https connectivity, squid, and wpad:

just took me a bit to realize I was having a moment of brain dead, THANK YOU ALL! - THX 😉

BTW:
if you want to perform a serious Squid + Squid Guard installation.
I have an acquaintance here on the forum and I can bring you together with him...☺

@rafamello

Como pensávamos, o problema é com *.GOV + cert.

Solved in https://forum.netgate.com/topic/153028/haproxy-deleting-acl-on-modify-bug-or-am-i-missing-something/14