araczek Posted January 15, 2014 Posted January 15, 2014 Been at this for days now. Proxy is on Windows Server 2003 and testing is done with a Windows 7 machine. Using Internet Explorer (v 9, 10) or Firefox when trying to load HTTPS pages the browser IMMEDIATELY shoots back a "this page can't be displayed" message. This does not happen with ALL HTTPS sites, just some. If I look in the cache.log file I see that the site I am trying is "allowed" by the proxy so it is getting to the proxy and is not denied. I have tried a couple registry jhacks for Bad Proxy Timeouts in Windows but no luck. This is driving me nuts and I REALLY NEED a resolution. A project needs access to an Internet site for testing and I can't seem to get them there. HELP!
araczek Posted January 15, 2014 Author Posted January 15, 2014 I'd like to but I don't see an option to make an attachment in the reply. Unless I make a ne thread.
localzuk Posted January 15, 2014 Posted January 15, 2014 You should be able to put the contents of the squid.conf file just as text in
localzuk Posted January 15, 2014 Posted January 15, 2014 Hmm... an initial glance doesn't have anything jump out at me.
cpjitservices Posted January 15, 2014 Posted January 15, 2014 (edited) Try enabling access to ssl and safe ports. Change the default deny for allow like this : http_access allow !Safe_ports http_access allow CONNECT !SSL_ports. Maybe this works for you! Be aware enabling this 'cause your granting access to other related ports in you acl list. So be sure to have a good firewall already configure in your network. Edited January 15, 2014 by cpjitservices
araczek Posted January 15, 2014 Author Posted January 15, 2014 Yes those sites have BEEN in the ACL for a while. I get the "allowed" message in the cache.log.
cpjitservices Posted January 15, 2014 Posted January 15, 2014 Try enabling access to ssl and safe ports. Change the default deny for allow like this : http_access allow !Safe_ports http_access allow CONNECT !SSL_ports. Maybe this works for you! Be aware enabling this 'cause your granting access to other related ports in you acl list. So be sure to have a good firewall already configure in your network. Yes those sites have BEEN in the ACL for a while. I get the "allowed" message in the cache.log.
araczek Posted January 16, 2014 Author Posted January 16, 2014 Try enabling access to ssl and safe ports. Change the default deny for allow like this : http_access allow !Safe_ports http_access allow CONNECT !SSL_ports. Maybe this works for you! Be aware enabling this 'cause your granting access to other related ports in you acl list. So be sure to have a good firewall already configure in your network. Maybe I'm wrong but doesn't http_access !Safe_Ports mean allow access to all ports NOT in the safe list? Same with http_access allow CONNECT !SSL_ports. Wouldn't that say essentially allow connect to all ports that are NOT SLL ports??? I am trying to connect to an SSL site. Forgive me if I am wrong.
Duke5A Posted January 16, 2014 Posted January 16, 2014 That config file is really hard to parse by hand with all the comments in it; here it is with the comments stripped: acl all src all acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 172.16.10.0 # RFC1918 possible internal network acl localnet src 172.16.80.0 # RFC1918 possible internal network acl SSL_ports port 443 acl SSL_ports port 873 # rsync_SSL acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 873 # rsync acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny to_localhost acl GoodHosts src "c:/squid/etc/squid-allowedhosts.acl" acl Goodsites dstdomain "c:/squid/etc/squid-site_noblock.acl" http_access allow GoodHosts Goodsites http_access allow localnet http_access deny all icp_access allow localnet icp_access deny all http_port 3128 cache_peer 127.0.0.1 parent 4001 7 no-query hierarchy_stoplist cgi-bin cache_dir ufs c:/squid/var/cache 3000 16 256 access_log c:/squid/var/logs/access.log squid logfile_daemon c:/squid/libexec/logfile-daemon.exe cache_log c:/squid/var/logs/cache.log cache_store_log c:/squid/var/logs/store.log mime_table c:/squid/etc/mime.conf pid_filename c:/squid/var/logs/squid.pid debug_options ALL,1 33,2 log_fqdn off unlinkd_program c:/squid/libexec/unlinkd.exe refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 acl apache rep_header Server ^Apache broken_vary_encoding allow apache connect_timeout 1 minute icon_directory c:/squid/share/icons error_directory c:/squid/share/errors/English dns_testnames abs.us.army.mil coredump_dir c:/squid/var/cache I used this Power Shell snippet to do it: Get-Content .\squid.conf2.txt | Where-Object { $_ -ne ''} | Where-Object { $_.SubString(0,1) -NotMatch '#' } > squidclean.conf Anyhow, since you said this only happens with a few HTTPS pages it's probably safe to assume you have your configuration correct. What is probably happening is the ones that are failing can't call back to the certificate authority for a revocation check. I actually had this happen to a handful of domains on my Squid box. My proxies require authentication to get out and the connection request to the CA wasn't passing credentials to the proxy so the connection attempt was being swatted down. This resulted in the same problem you're having - where most SSL pages will work, but some won't. I know you're not using authentication, but from the looks of it you're using a whitelist setup and this would require the domains for those certificate authorities to be part of the list. Here is a couple: .verisign.com .usertrust.com .entrust.net There are probably more that can be added. You can find them easily enough by browsing to one of the sites that don't work while looking at the access log. There will be a deny request right next to the allow for the domain you're trying to access and it'll be for a certificate authority. Add the domain to your noblock ACL and you should be good. I hope this helps.
araczek Posted February 19, 2014 Author Posted February 19, 2014 Sir, thank you for your response! We had done a workaround but it seems this won't suffice. Are you saying check access.log? Don't see much there. I will try cache.log next.
araczek Posted February 19, 2014 Author Posted February 19, 2014 What I do see in the access.log are TCP_MISS/404 if that means anything. Site not found??
araczek Posted February 20, 2014 Author Posted February 20, 2014 Tried modifying the allowed sites list with: .com .net .gov .edu That's it, nothing else. So not much is blocked but I still have the same problem.
araczek Posted February 20, 2014 Author Posted February 20, 2014 Found the problem. I tried using an older version of Internet Explorer (7) and that gave me more information to troubleshoot with. Squid returned a DNS error on a Squid error page, something I did not see before. Went ahead and hard coded the external DNS servers in the squid.conf and it finally works. Was a bear though.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now