Discussion:
[squid-users] Using CA signed certificate for SSL bump
Arshad Ansari
2018-09-05 07:02:45 UTC
Permalink
Hi All,



I have setup squid 4.2 for forward proxy and caching. It is working fine when I am using self-signed certificate for SSL bump.



However, our security requirement is to use only CA signed certificate and not self-signed certificate.



I have tried various options like using Https and intercept but nothing seems to be working.



My question is does SSL work with CA signed certificate?



Regards,
Arshad
Antony Stone
2018-09-05 08:29:55 UTC
Permalink
Post by Arshad Ansari
Hi All,
I have setup squid 4.2 for forward proxy and caching. It is working fine
when I am using self-signed certificate for SSL bump.
Good. Well done.
Post by Arshad Ansari
However, our security requirement is to use only CA signed certificate and
not self-signed certificate.
That won't work.
Post by Arshad Ansari
I have tried various options like using Https and intercept but nothing
seems to be working.
Indeed.
Post by Arshad Ansari
My question is does SSL work with CA signed certificate?
SSL? Yes.

SSL Bump / interception, no - because if it did, you'd have a globally-trusted
certificate which you could use to fake any website on the Internet.

Security? The CA who gave you that certificate would disappear.


Antony.
--
Tinned food was developed for the British Navy in 1813.

The tin opener was not invented until 1858.

Please reply to the list;
please *don't* CC me.
Flashdown
2018-09-05 10:02:36 UTC
Permalink
Hey,

How should that work? That would require an ca to sign your selfsigney ca to be able to issue valid public certs for all websites. If that would be possible, then the whole concept of ssl security would be worth nothing. You cant create valid certificates for such websites. You can only issue certs that are valid in your organisation only. Therefore the selfsigned ca needs to be trusted by your clients by adding it in the trust root authorities. There is no other way, wait, there is, do not try to intercept ssl secured connections. So you cant look in the traffic as it is supposed to be. Or break it and live with the needs required for this. If you have no valid reason to intercept sich traffic then just dont do it.
Post by Arshad Ansari
Hi All,
I have setup squid 4.2 for forward proxy and caching. It is working
fine when I am using self-signed certificate for SSL bump.
However, our security requirement is to use only CA signed certificate
and not self-signed certificate.
I have tried various options like using Https and intercept but nothing seems to be working.
My question is does SSL work with CA signed certificate?
Regards,
Arshad
Alex Crow
2018-09-05 11:05:17 UTC
Permalink
You can set up your own internal CA. You then have the CA key (so can
generate certificates for any domain) and install the CA public
certificate on all client machines.


That CA can be anything from a local CA on the squid box, using a
central VM with something like XCA installed, all the way to an
enterprise HSM.


But you must have the CA key. There is no way a commercial CA would give
you a universal signing key.


Alex
Post by Arshad Ansari
Hi All,
I have setup squid 4.2 for forward proxy and caching. It is working
fine when I am using self-signed certificate for SSL bump.
However, our security requirement is to use only CA signed certificate
and not self-signed certificate.
I have tried various options like using Https and intercept but
nothing seems to be working.
My question is does SSL work with CA signed certificate?
Regards,
Arshad
_______________________________________________
squid-users mailing list
http://lists.squid-cache.org/listinfo/squid-users
Loading...