Michael I. <linux-michae...@abwesend.de> wrote: > But I have a new problem, I want to have a transparent proxy for http > this works fine but when I add the iptables rule for https the loading > won't work.
Of course not. That this is not working is the _whole point_ of any end-to-end encrypted connection. What you are effectivly trying to do is an Man-in-the-Middle "attack". You cannot transparently proxy *any* encrypted connection without major trickery, like I wrote in my first mail. You would need a fake CA certificate (why this is a _very_ bad idea you just have to look at the latest CNNIC and MSC debacle: (sorry, German URL) <https://www.psw-group.de/blog/cnnic-signiert-falsche-google-zertifikate/2112> or <http://www.heise.de/security/meldung/Google-deckt-erneut-Missbrauch-im-SSL-Zertifizierungssystem-auf-2583414.html>), and have your proxy terminate the end-to-end encryption by issuing a fake certificate on the fly, so that the client is satisfied and then create another new encrypted connection to the intended end-point. There _are_ security appliances out there which work in that way but they are considered _very_ *very* bad practice and should be avoided at all costs. Grüße, Sven. -- Sigmentation fault. Core dumped. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/11bg3gmtro...@mids.svenhartge.de
