Squid makes false certificates on some pages

[Rau]

Hello everybody,
I use Pfsense 2.3.2-p1 with Squid 0.4.23_1. I have activated SSL filtering, because I want to prevent downloads and lock web sites.

Now to my Problem
In most cases everything runs as it should I get on HTTPS pages valid certificates from PFSENSECA-> website. In some cases, however, the whole thing does not work, because instead of PFSENSECA-> website is an IP ADDRESS issued with an expired date. As an example I took https://emby.media

See pictures
Without Squid

With Squid

I think it is a setting problem of my side, but could not yet determine which is.

Hope you can help me.

Thanks and regards

[Rau]

I have just found out if I disable transparent-proxy and make the proxy settings manually, it runs perfectly.
But this is not a good solution for me

[KOM]

Using squid in explicit mode along with WPAD is almost as seamless as transparent mode.

[Rau]

Thanks for the answer.
I have now switched to WPAD and switched off the SSL Filtering. Works so far quite well, but I get on locked websites now an HTTP 404 instead of my Costum Page. Can do something about it?

Thanks and regards

[Rau]

I just noticed that I can not block downloads in this configuration. Is that right?

[KOM]

but I get on locked websites now an HTTP 404 instead of my Costum Page. Can do something about it?

I don't understand what you mean here.

I just noticed that I can not block downloads in this configuration. Is that right?

You can with squidguard.  squid by itself is just a cache.

[Rau]

Hi,
I used Squidguard, I have a rule under Target Categories with the content "(.\ /..(Exe|msi)) under Regular Expression. If I have enabled SSL filtering, downloads are blocked, now with WPAD I disable the SSL filtering and the rule does not work anymore.

In Squidguard, I have the redirect mode "ext url err page (enter URl )" Redirect Info "http://domain/blocked.php?Clientaddr=%a&clientname=%n&clientuser=%i&clientgroup=%s&url=%u" The clients get then displayed a Custom Error Page.
If SSL filtering is deactivated, it only shows "Make sure the web address … is correct"

Regards

[KOM]

Ah OK.  This is normal behaviour with HTTPS, squidguard and explicit proxy I believe.

[Rau]

Is there a way to change that? Or is there a way to get the transparency mode running properly?

Regards

[KOM]

I don't know for sure, but I do know that transparent mode is more trouble than its worth.