Squid SSL transparent proxy - ssl-certificate

Question

It just doesn't work, does it?
Firefox OK after installing the .pem file, but other applications not working.
Converted the .pem file to a .crt using
# openssl x509 -outform der -in myCA.pem -out myCA.crt
and installed it as a Trusted Root Certification Autnorities in certlm but still lots of things not working: Outlook, Teams, GoogleDrive,...

Answer 1

It seems to be very unreliable.
This is the configuration (from https://elatov.github.io/2019/01/using-squid-to-proxy-ssl-sites/) that's got Squid working. I have no idea why -- I just got lucky.
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all
ssl_bump splice all
with
the .pem in the browser as an Authority, and
the .crt in Windows as a Trusted Root Certification Authorities.
For the exceptions the best approach is to not send them to Squid in the first place. Using the -d flag with a domain name in the iptables command simply resolves it to an IP address at the time the command therefore it's better to maintain an ipset that iptables can reference.
Here is my script for maintaining my ipset with the domains in a text file.
The idea is that this can be run as a cron job to pick up new domains and update the map to IP addresses.
#!/bin/sh
## Bypass Squid
ipset -L no-proxy >/dev/null 2>&1
if [ $? -ne 0 ]; then
echo "Creating ipset: no-proxy."
ipset create no-proxy hash:ip
fi
ipset flush no-proxy
if [ -f "/etc/squid/no-proxy-iptables.txt" ]; then
for domain in $(cat /etc/squid/no-proxy-iptables.txt); do
for address in $( dig a $domain +short | grep -P -e '^(\d{1,3}\.){3}\d{1,3}$' ); do
echo $domain " -> " $address
ipset add no-proxy $address
done
done
else
echo "File doess not exist: /etc/squid/no-proxy-iptables.txt"
fi
And here is my firewall script:
#!/bin/sh
iptables -t nat -F
iptables -t mangle -F
iptables -F # Does NOT flush everything! Hence the other three commands.
iptables -X
# Squid: exceptions
ipset -L no-proxy >/dev/null 2>&1
if [ $? -eq 0 ]; then
echo "Using ipset: no-proxy."
iptables -t nat -A PREROUTING -i br0 -m set --match-set no-proxy dst -j ACCEPT
fi
# Squid: HTTP
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j DNAT --to 192.168.1.31:3128
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 3128
# Squid: HTTPS
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to 192.168.1.31:3129
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j REDIRECT --to-port 3129
# IP masquerade
iptables -A FORWARD -o wlan0 -i br0 -s 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o enp0s6f1u2 -j MASQUERADE
# echo 1 > /proc/sys/net/ipv4/ip_forward
iptables-save > /etc/iptables/rules.v4
You seem to be able to get a good guess at what domains to bypass by keeping an eye on the network tab in the browser dev tools.