Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Newbie HTTPS question

    Scheduled Pinned Locked Moved General pfSense Questions
    7 Posts 3 Posters 424 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sysoverload
      last edited by

      Enabling https inspection with self-signed SSL cert means having to install certification on every device to avoid the pesky error messages from browsers.
      Can you use a lets encrypt cert to do https if not what is recomended

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @sysoverload
        last edited by

        @sysoverload said in Newbie HTTPS question:

        Can you use a lets encrypt cert to do https

        That's right.
        But, be aware, it's not a free ride : you can only ask a trusted certificate from acme when you use a real domain name - a domain name that you bought / rent / own.
        "pfsense.lan.net" or *lan.net" or *.lan.net" (wild card) won't do because you do not "own" that domain name.

        With a wild-card cert you can load the cert on any device you have on your LAN, like printers, etc.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          It doesn't work like that...

          Lets say your client wants to go to https://www.google.com, the proxy has has to hand back a cert that says its for www.google.com, Or your browser is going to bitch.

          How do you think acme could do that?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan
            last edited by

            Hummm. I guess I was reading " to do https" => accessing the GUI using https ....

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              Maybe - but the use of "https inspection"

              Seems more like he is asking how to inspect https via proxy.. If all he wants is his browser to not balk at his web gui access then yeah that is simple enough to do with acme.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • S
                sysoverload
                last edited by

                @johnpoz said in Newbie HTTPS question:

                s say your client wants to g

                looking for a way to block https sites without having to install a cert on every device behind it

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  You can block without trusting.. You have to use explicit (I believe), ie the client has to point to the proxy.. It will send the connect command for https, so proxy know where trying to go, and can either allow or deny based on that host name...

                  What you can not do is allow say www.domain.com but block www.domain.com/something without doing mitm... Since onlly the host is sent in the connect.

                  There is a hangout that I believe goes over this stuff - let me see if can find it.
                  edit: here you go
                  https://www.netgate.com/resources/videos/squid-squidguard-and-lightsquid-on-pfsense-24.html
                  peek&splice.png

                  edit: Also if all your looking to do is block access to sites, be it http or https wouldn't pfblocker be another option?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.