Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #180204

Re: ssl isues are Eating me alive.

Show all headers | View raw

On Thu, Apr 13, 2017 at 09:04:01PM +0100, Darac Marjal wrote:
> It looks[1] like Squid can do SSL Interception. I imagine it should be
> possible, therefore, for squid to perform the HTTPS connection and
> either downgrade it to HTTP or to re-encrypt it with a lower grade. YMMV

Well automatic downgrade to HTTP could work, not sure how to implement it,
but often you'll experience issues due to missing SNI support.
For example in the case of elinks you can find the following open wishlist bug
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797968
So that issue will continue to exist in stretch but that's not the fault of
GNUTLS but an application issue.

In regards of cipher support at least GNUTLS from jessie should work with
most public sites. For wheezy the situation might be more complicated.

Regarding Squid I *think* it's also missing SNI support at the moment and
for sure in wheezy.

Long story short: You need a somewhat recent GNUTLS release (jessie should
be fine) and application level support en par with that.

Sven

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

ssl isues are Eating me alive. "Martin McCormick" <martin.m@suddenlink.net> - 2017-04-13 19:00 +0200
  Re: ssl isues are Eating me alive. Greg Wooledge <wooledg@eeg.ccf.org> - 2017-04-13 19:10 +0200
    Re: ssl isues are Eating me alive. Darac Marjal <mailinglist@darac.org.uk> - 2017-04-13 22:10 +0200
      Re: ssl isues are Eating me alive. Sven Hoexter <sven@timegate.de> - 2017-04-17 16:00 +0200
    Re: ssl isues are Eating me alive. "Martin McCormick" <martin.m@suddenlink.net> - 2017-04-13 22:50 +0200
    Re: ssl isues are Eating me alive. Reco <recoverym4n@gmail.com> - 2017-04-14 12:00 +0200
      Re: ssl isues are Eating me alive. davidson@freevolt.org - 2017-04-15 17:20 +0200
        Re: ssl isues are Eating me alive. Reco <recoverym4n@gmail.com> - 2017-04-15 19:20 +0200
          Re: ssl isues are Eating me alive. Sven Hoexter <sven@timegate.de> - 2017-04-17 16:10 +0200

csiph-web