In practice POST url always better to get splice. This prevents much errors.
SSL3_GET_SERVER_CERTIFICATE itself means that some client application trying to establish secure connection uses old SSLv3 protocol. This applications also better to splice, if not possible to upgrade applications (often it is not possible). 11.12.2017 7:06, G~D~Lunatic ??????????: > my squid is a transparent proxy. > when i use WeChat client upload file or picture, it failed. > the access.log shows that > 1512953345.798?0?2?0?2?0?2?0?2 75 192.168.51.15 TAG_NONE/200 0 CONNECT > 111.206.23.97:443 - ORIGINAL_DST/111.206.23.97 - > 1512953345.805?0?2?0?2?0?2?0?2?0?2 0 192.168.51.15 TAG_NONE/503 4380 POST > https://msg.71.am/v5/ypt/hcdn_multicurl - HIER_NONE/- text/html > 1512953349.713?0?2?0?2?0?2?0?2 10 192.168.51.15 TAG_NONE/200 0 CONNECT > 101.226.152.108:443 - HIER_NONE/- - > 1512953350.931?0?2?0?2?0?2?0?2 10 192.168.51.15 TAG_NONE/200 0 CONNECT > 123.151.76.49:443 - HIER_NONE/- - > 1512953354.059?0?2?0?2?0?2?0?2 11 192.168.51.15 TAG_NONE/200 0 CONNECT > 123.151.76.49:443 - HIER_NONE/- - > > i used wireshark catch the package, Encrypted Alert was shown. > i want to know where the problem or how i can do. > Here is my configure > > https_port 192.168.51.200:3129 intercept ssl-bump connection-auth=off > generate-host-certificates=on dynamic_cert_mem_cache_size=4MB > cert=/usr/local/squid/ssl_cert/myCA.pem > key=/usr/local/squid/ssl_cert/myCA.pem options=NO_SSLv3,NO_SSLv2 > > > acl broken_sites ssl::server_name matchweb.sports.qq.com > acl ssl_step1 at_step SslBump1 > acl ssl_step2 at_step SslBump2 > acl ssl_step3 at_step SslBump3 > ssl_bump splice broken_sites > #ssl_bump splice all > ssl_bump stare ssl_step1 > ssl_bump bump ssl_step2 > ssl_bump terminate ssl_step3 > > > > > > > > > > > _______________________________________________ > squid-users mailing list > squid-users@lists.squid-cache.org > http://lists.squid-cache.org/listinfo/squid-users -- "Some people, when confronted with a problem, think ?0?0I know, I'll use regular expressions.?0?3 Now they have two problems." --Jamie Zawinsk ************************** * C++: Bug to the future * **************************
signature.asc
Description: OpenPGP digital signature
_______________________________________________ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
