Re: [squid-users] Squid 5: server_cert_fingerprint not working fine...

[UnveilTech - Support]

Hi Amos,

Quick update...
A 10 lines PHP helper is able to catch the SHA1 key with a basis 
"openssl_x509_fingerprint" function when Squid, a 1 million lines product, 
could not be able ?

Samples from the helper:
apple.com tls1.3, SHA1: 
"7B:B1:94:4F:56:5D:7D:64:A1:45:5C:91:E5:BA:0C:EA:D9:FB:91:50"
xforce-cracks.com tls1.3, SHA1: 
"31:3E:E1:3D:FD:B1:0A:C0:CA:AF:30:47:0A:BA:A1:49:D4:08:42:2A"

I'm sure the Squid team can do better than a PHP function 😊

Bye Fred

-----Message d'origine-----
De : UnveilTech - Support 
Envoyé : vendredi 18 novembre 2022 14:56
À : 'Amos Jeffries' <squ...@treenet.co.nz>; squid-users@lists.squid-cache.org
Objet : RE: [squid-users] Squid 5: server_cert_fingerprint not working fine...

Hi Amos,

We have tested with a "ssl_bump bump" ("ssl_bump all" and "ssl_bump bump 
sslstep1"), it does not solve the problem.
According to Alex, we can also confirm it's a bug with Squid 5.x and TLS 1.3.
It seems Squid is only compatible with TLS 1.2, it's not good for the future...

Bye Fred

-----Message d'origine-----
De : squid-users [mailto:squid-users-boun...@lists.squid-cache.org] De la part 
de Amos Jeffries Envoyé : vendredi 18 novembre 2022 06:34 À : 
squid-users@lists.squid-cache.org Objet : Re: [squid-users] Squid 5: 
server_cert_fingerprint not working fine...

On 18/11/2022 5:02 am, UnveilTech - Support wrote:
>
> Hello Squid Team,
>
> Can you have a look to this bugzilla case :
>
> https://bugs.squid-cache.org/show_bug.cgi?id=5245
>
> it’s about a bug with Squid 5.7 and TLS 1.3.
>
> Critical case created the 2022-10-27 09:59 UTC, it would be nice to 
> have a fix/patch…
>
>   occur)
>

As one can see in the bug report Alex has looked at it in some detail.
The solution may be complex or large change, and thus unlikely to occur in 
Squid-5 if so.

There are three things that come to mind immediately as related problems we 
cannot do anything about:
  1) Squid cannot know in advance what server cert will be provided (after 
step2) when it decided to splice (or not) at step2.
  2) SHA1 is not the only type of cert fingerprint. The non-working certs may 
be providing newer SHA2/3 etc fingerprints
  3) In TLS/1.3 a lot of data can be hidden inside the encryption. Squid may 
simply not be given access to the [real] fingerprint unless bump
(decrypt) happens.

HTH
Amos

_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users