Re: [squid-users] Reverse proxy: http to https and certificate authentication

Mailing List SVR wrote:
> Il giorno dom, 01/02/2009 alle 21.56 +1300, Amos Jeffries ha scritto:
>> Mailing List SVR wrote:
>>> Il giorno dom, 01/02/2009 alle 20.28 +1300, Amos Jeffries ha scritto:
>>>> Mailing List SVR wrote:
>>>>> Hi all,
>>>>>
>>>>> I have a soap client using python ZSI, the other end is oracle soa
>>>>> 10.1.3.1.0 all works fine since some months. The last week oracle soa
>>>>> was configured to accept client certificate authentication over https.
>>>>> If I try to use the standard python httplib.HTTPSConnection library it
>>>>> fails with the infamous "bad record mac" error and so also ZSI that use
>>>>> httplib. Other java tools such as soapui works just fine with oracle
>>>>> soa.
>>>>>
>>>>> Can squid do the hard work for me in the following configuration?
>>>>>
>>>>> ZSI soap client -> squid proxy over http -> oracle soa https
>>>>>
>>>>> however squid could be authenticate to oracle soa loading the cert file
>>>>> and the cert key from a local file.
>>>>>
>>>>> So I would like to send my soap request to squid over http and squid
>>>>> could connect to oracle soa over https presenting its own client
>>>>> certificate (not send from my application but load from local file).
>>>>>
>>>>> Is this configuration possible?
>>>>>
>>>>> thanks
>>>>> Nicola
>>>>>
>>>>>
>>>> Yes Squid can certainly act as a HTTP->HTTPS proxy for you.
>>>> Just configure a normal cache_peer pointing at oracle to using SSL,
>>>> http://www.squid-cache.org/Doc/config/cache_peer/
>>>> and configure ZSI to connect to the Squid HTTP port without SSL.
>>> thanks but squid need to present a client certificate to authenticate
>>> against oracle, cache peer seems lack directive to specify certificate,
>>>
>> Look again:
>> ssl
>> sslcert=/path/to/ssl/certificate
>> sslkey=/path/to/ssl/key
>> sslversion=1|2|3|4
>> sslcipher=...
>> ssloptions=...
>>
>>
>
> You are right but I'm ot a squid expert so I need some more directions
> please.
>
> I added this line to squid.conf
>
> cache_peer <oraclesoahostname> parent 443 0 no-query no-digest
> no-netdb-exchange proxy-only default ssl
> sslcert=/etc/squid/cert/clients1.crt sslkey=/etc/squid/cert/clients1.key
> sslversion=1
>
> <oraclesoahostanme> is in my hosts file,
>
> now how squid redirect the request to <oraclesoahostname> and how I can
> connect to squid? On standard 3128 port (for example wget
> http://<squidip>:squidport/<what here?>>) or I have to use it as http
> proxy (export HTTP_PROXY=...)?
>
> thanks for your patience,
>
> Nicola
>

Depends on whether Squid is listening on.
Normal http_port 3128 is connected to normally as any other proxy with
HTTP to port 3128.

If the certificate is working, squid will startup and mention that its
read and checked the cert. And requests go out to the peer.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE5 or 3.0.STABLE12
   Current Beta Squid 3.1.0.4