0

I am using havp and squid. How do I scan HTTPS connections with havp anti-virus?

Right now, testing eicar http://www.eicar.org/85-0-Download.html proves that anti-virus havp is working with havp. On HTTP only. HTTPS, the fake virus file downloads without warning.

I've read a few blurbs on sslbump from squid, but nothing coherent.

Improve this question

1 Answer 1

Reset to default
1

https sessions are encrypted so scanning it for viruses is a futile exercise. Since any virus would be masked by the encryption.

On the HAVP website there is only 1 topic regarding this. Basically you need to turn the request into a http request and scan that instead of the https request:

  1. You will need to create a CA-root, then sign a wildcard certificate with the CA-root, then tell apache to use these files.
  2. You need to import the root in your browser.
  3. You can set up a virtualhost on port 8443, transparently forward all outgoing SSL traffic to this port, then tag all SSL-traffic with a extra header, then let it through HAVP, and then read off this header at the other end to decide if the connection should be SSL or not, and then rewrite the urls so they go through HAVP proxy.
  4. Then you need a virtualhost on 8448, accepting standard HTTP, that tags traffic for HTTP and send it to HAVP.

That topic also has one and two example apache configurations.

Improve this answer
1
  • Thanks, that's solid info but doesn't help troubleshooting. I ran into a mysterious error: <br> [Mon Mar 11 15:55:13 2013] [warn] Init: Session Cache is not configured [hint: SSLSessionCache], upon restarting apachectl restart.
    – user108754
    Mar 12, 2013 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .