Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!us.feeder.erje.net!news2.arglkargh.de!newsfeed.fsmpi.rwth-aachen.de!newsfeed.straub-nv.de!news-1.dfn.de!news.dfn.de!news1.uni-leipzig.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Tim Watts Newsgroups: uk.d-i-y,uk.comp.os.linux,comp.os.linux.misc Subject: Re: Parental guardian - internet (WEB) filtering Date: Sun, 05 Apr 2015 10:58:16 +0100 Lines: 25 Message-ID: References: <8ri4vb-ele.ln1@squidward.dionic.net> <3LWdnbt1u_puCb3InZ2dnUVZ8s2dnZ2d@brightview.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net KIjS7lqaNFJDMLzDDsureQ9+mVclWKVsFMadS+r+NljCDo+RQi X-Orig-Path: squidward.dionic.net!not-for-mail Cancel-Lock: sha1:201UgUWqjADeNp5JrcU8Df9eXGA= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 In-Reply-To: <3LWdnbt1u_puCb3InZ2dnUVZ8s2dnZ2d@brightview.co.uk> Xref: csiph.com comp.os.linux.misc:14342 On 05/04/15 02:50, Andy Burns wrote: > Tim Watts wrote: > >> it is fundamentally impossible to proxy an >> SSL connection at anything above the TCP datastream as you'd need copies >> of the target SSL certs to be able to fake a session that was valid to >> the client. >> >> No amount of squid clever-trickery can help with that. > > Create your own CA, tell all the household machines to trust its > certificate as a CA, intercept all SSL, create a certificate on the fly > for the domain being accessed signed by the CA ... oooo... That could work - by by *** that's devious! > it's what Microsoft > TMG does (and no doubt others) would be surprised if it's not do-able > with squid. > > >