I need to setup a transparent SSL reverse proxy with (already ssl enabled) squid 3.3.8.

Squid should NOT be the ssl endpoint in this setup, so it should only accept the ssl connection and forward everything to the ssl enabled backendserver. MITM/SSLbump is not needed, everything should go through encrypted.

Can someone give me a hint on where to look in the squid manual/wiki on how to set this up? What is the correct term to describe this setup?



I don't think that's possible. In forward-proxy scenarios yes, because the proxy just forwards the request to the resolved destination without decryption and analysis. But in reverse proxy, since the header is encrypted, the proxy server wouldn't know what to do with the request...unless it can decrypt it and see what the request actually is. Below is an exerpt from Squid documentation for version 2.5. I know you asked about version 3.3, but I think the point is still quite valid.

It is possible to intercept an HTTPS connection to an origin server at Squid's https_port. This may be useful in surrogate (aka, http accelerator, reverse proxy) environments, but limited to situations where Squid can represent the origin server using that origin server SSL certificate. In most situations though, intercepting direct HTTPS connections will not work and is pointless because Squid cannot do anything with the encrypted traffic -- Squid is not a TCP-level proxy.

source: http://wiki.squid-cache.org/Features/HTTPS

If you can provide some details about your intention with the reverse proxy, and why you want to avoid a MITM config, maybe another solution will present itself.

Lastly, to specifically answer your question about the best source of documentation... I find the default squid.conf file to be very helpful.

  • Thanks James! I was put onto this task by my boss, which claims "this is no problem, I have done this myself blah blah blah". So got curious on how to do this, because I could not find anything about it. Seems it was (as usual) a load auf BS by my boss..... – user3528657 Mar 12 '17 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.