Squid and SSL bump

[Blue_Cookeh]

Hi All,

 

Setting up a shiny new Squid install on Debian to (finally...) replace our basic TMG filtering and am going down the SSL intercept (or so called SSL bump) route.

 

I've managed to get an Intermediate CA out of our Microsoft CA server and Squid is successfully using that, but the problem is it doesn't seem to be passing the entire SSL chain through to the client on SSL'd websites, so it's not trusted. As soon as I import the Intermediate CA into my clients they accept the generated SSL certificate on the website and everything is green, it recognises that our Root CA has signed the Intermediate CA that has signed the website CA.

 

Any ideas how to get Squid to pass the chain to the client? I'd rather not have to import the Intermediate CA on every device if possible.

 

Many thanks

[AdonMalik]

The short answer is that to do this you'll need to install the intermediate CA or root CA public cert into the trusted certificate store of every device that connects to HTTPS sites through it.

 

The reason for this is that the client is actually only making a SSL connection to your Squid box, not the site they think they're going to. As a result Squid can only give them the certificate it has for the signing of connections. Since the Squid box is essentially performing a man-in-the-middle attack on the connection it would need the private key of each site visited in order to resign the connection when it's passed to the internal client. This is actually a security mechanic of SSL so it's not something you can really bypass. You could push the intermediate CA cert through a GPO pretty easily though; if you want details let me know and I'll pull them from out GPO that does that very thing.

 

The other part to consider in all of this is that SSL interception is likely required to be disclosed to the end user under UK laws (it is in most countries) but IANAL or based in the UK so I'm not able to say for certain. Even if it's not disclosed anyone inspecting the certificate that is encrypting their connection can figure it out due to what you have to do in order to squelch the browser warnings when implementing this.

 

Hope that helps .