1

I have installed Squid 3.15 on Ubuntu 15.10 server. Squid was setup with sslbump for https traffic. The functionality works without any problem i.e.: all traffic from both http and https goes through Squid and all internet can be accessed on all devices where certificates are installed.

One exception is: 'Netflix APP' no longer works on IOS devices (iPhone, iPad). No matter what I do. All other internet services (Safari and other apps) work properly on those devices.

I was able to run Netflix from browser on Linux boxes and even OS X Safari. The only thing that is not working is Netflix APP on IOS.

Of course if I disabled sslbump and only allowed http to go through Squid Netflix works. I tried both transparent mode and proxy mode on the iPhone, still not working.

Did anyone manage to make Netflix APP on IOS devices work with squid with sslbump enabled ?

1

The problem is that the netflix app uses certificate pinning.

"Certificate Pinning is where you ignore that whole thing, and say trust this certificate only or perhaps trust only certificates signed by this certificate."
https://security.stackexchange.com/questions/29988/what-is-certificate-pinning

I would recommend you upgrade to Squid 3.17 because you likely will want to use tranparent mode because there is no way on the ipad to configure the netflix app to connect to other ports. 3.17 now allows peek and splice in transparent mode

"Our goal is to allow our users to browse some important web pages (like banking or payments systems) without SSL interception (it's called Splice in Squid's terminology) but the rest of HTTPS traffic should be intercepted ("bumped") in order to verify the content." "Now thanks to the TLS extension in HTTPS standard (introducing SNI) and Squid's peek & splice feature it's possible to determine server_name by peeking at client's request (as long as the client is TLS/SNI compatible)."

http://marek.helion.pl/install/squid.html <--awesome, thank you Marek!

This is what I ended up doing

acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl nobumpSites ssl::server_name .netflix.com

# Peek at client's TLS-request in order to find the SNI
ssl_bump peek step1 all         
# don't bump the nobumpSites
ssl_bump splice step2 nobumpSites    

# bumping all other SSL connections
ssl_bump bump                  

If you don't know what the SNI should be (.netflix.com) use wireshark to look at the client hello. Because the netflix client traffic is https the only way for squid to know what the domain is to peek at the unencrypted client hello that should contain the SNI.

I should note it takes the ipad netflix app about 60 seconds to start playing the video. I have an idea why and will update here later.

Important note (not implemented above) "Can squid mitm SSL connections, but deliberately generate invalid certs for upstream connections which are self signed or invalid so my browser will flag them?" "The current Squid do that provided you do the SSL-Bump "bump" action at step3 when the server details are known." http://lists.squid-cache.org/pipermail/squid-users/2016-March/009707.html <--Big thanks to Amos for all the squid knowledge he shares!

Other sources http://www.squid-cache.org/Doc/config/acl/

http://lists.squid-cache.org/pipermail/squid-users/2016-April/010009.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.