The problem is that the netflix app uses certificate pinning.
"Certificate Pinning is where you ignore that whole thing, and say trust this certificate only or perhaps trust only certificates signed by this certificate."
I would recommend you upgrade to Squid 3.17 because you likely will want to use tranparent mode because there is no way on the ipad to configure the netflix app to connect to other ports. 3.17 now allows peek and splice in transparent mode
"Our goal is to allow our users to browse some important web pages (like banking or payments systems) without SSL interception (it's called Splice in Squid's terminology) but the rest of HTTPS traffic should be intercepted ("bumped") in order to verify the content."
"Now thanks to the TLS extension in HTTPS standard (introducing SNI) and Squid's peek & splice feature it's possible to determine server_name by peeking at client's request (as long as the client is TLS/SNI compatible)."
http://marek.helion.pl/install/squid.html <--awesome, thank you Marek!
This is what I ended up doing
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl nobumpSites ssl::server_name .netflix.com
# Peek at client's TLS-request in order to find the SNI
ssl_bump peek step1 all
# don't bump the nobumpSites
ssl_bump splice step2 nobumpSites
# bumping all other SSL connections
If you don't know what the SNI should be (.netflix.com) use wireshark to look at the client hello. Because the netflix client traffic is https the only way for squid to know what the domain is to peek at the unencrypted client hello that should contain the SNI.
I should note it takes the ipad netflix app about 60 seconds to start playing the video. I have an idea why and will update here later.
Important note (not implemented above)
"Can squid mitm SSL connections, but deliberately generate invalid certs for upstream connections which are self signed or invalid so my browser will flag them?"
"The current Squid do that provided you do the SSL-Bump "bump" action at
step3 when the server details are known."
<--Big thanks to Amos for all the squid knowledge he shares!