How to generate Internal Certificate Authority?

  • Thread starter Deleted member 55181
  • Start date
D

Deleted member 55181

Guest
I need to generate:

Create an internal Certificate
Click to expand...
using a Certificate Authority defined on the CAs tab by choosing the appropriate CA and filling out the form
Click to expand...

Like a from video:

04:27 to 05:23


I tried on pfsense and everything working correctly but when I tried to migrate to FreeBSD then Squid starting correctly but I have ,,You Connection is Not Secure" and I cannot generate working CAs.
this is good solution?... https://www.freebsd.org/doc/handbook/openssl.html
 
Ahem - you are not a valid certificate authority (obviously). The browser does not have your made-up certificate authority in its list of valid ones (obviously).
 
Is NOT nessesery. That's the point.
 
It IS necessary if you use self-signed certificates because those certificates have NOT been signed by a trusted certificate authority. Either your pfSense uses a trusted certificate to sign your certificate request OR your clients have the pfSense CA certificate added to their certificate store.
 
But how to generate exactly the same certificates?
 
User11 said:
But how to generate exactly the same certificates?
Click to expand...

If I read this correctly, you are missing the point. Self signed certificates have a lower level of trust than ones that are verified against a CA who is effectively saying "yeah, I know him and he's who he says he is". You DONT generate the SAME CERTIFICATE as a CA.
 
ssl_bump is the key. And Yes. I do not know how do "Descriptive name".

This is a config from pfsense. I disable:

#cache_effective_user squid
#cache_effective_group proxy



and


cache deny all

#cache_mem 64 MB
#maximum_object_size_in_memory 256 KB
#memory_replacement_policy heap GDSF
#cache_replacement_policy heap LFUDA
#minimum_object_size 0 KB
#maximum_object_size 4 MB
#cache_dir ufs /var/squid/cache 100 16 256
#offline_mode off
#cache_swap_low 90
#cache_swap_high 95
#cache allow all




Code: 
# This file is automatically generated by pfSense
# Do not edit manually !

http_port 10.1.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

icp_port 0
digest_generation off
dns_v4_first off
pid_filename /var/run/squid/squid.pid
#cache_effective_user squid
#cache_effective_group proxy
error_default_language tr
icon_directory /usr/local/etc/squid/icons
visible_hostname pfsense
cache_mgr samet@wireless.com.tr
#access_log /dev/null
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable off
pinger_program /usr/local/libexec/squid/pinger
sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db -M 4MB -b 2048
sslcrtd_children 5
sslproxy_capath /usr/local/share/certs/
sslproxy_options NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
sslproxy_cipher EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS
sslproxy_flags DONT_VERIFY_PEER
sslproxy_cert_adapt setValidBefore all

logfile_rotate 0
debug_options rotate=0
shutdown_lifetime 3 seconds
# Allow local network(s) on interface(s)
acl localnet src  10.1.1.0/24
forwarded_for delete
via off
httpd_suppress_version_string on
uri_whitespace strip

acl dynamic urlpath_regex cgi-bin \?
#cache deny dynamic
cache deny all

#cache_mem 64 MB
#maximum_object_size_in_memory 256 KB
#memory_replacement_policy heap GDSF
#cache_replacement_policy heap LFUDA
#minimum_object_size 0 KB
#maximum_object_size 4 MB
#cache_dir ufs /var/squid/cache 100 16 256
#offline_mode off
#cache_swap_low 90
#cache_swap_high 95
#cache allow all
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:    1440  20%  10080
refresh_pattern ^gopher:  1440  0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
refresh_pattern .    0  20%  4320


#Remote proxies
#cache_peer bla bla round-robin here.

# Setup some default acls
# ACLs all, manager, localhost, and to_localhost are predefined.
acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3129 1025-65535
acl sslports port 443 563

acl purge method PURGE
acl connect method CONNECT

# Define protocols used for redirects
acl HTTP proto HTTP
acl HTTPS proto HTTPS

# SslBump Peek and Splice
# http://wiki.squid-cache.org/Features/SslPeekAndSplice
# http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
# Match against the current step during ssl_bump evaluation [fast]
# Never matches and should not be used outside the ssl_bump context.
#
# At each SslBump step, Squid evaluates ssl_bump directives to find
# the next bumping action (e.g., peek or splice). Valid SslBump step
# values and the corresponding ssl_bump evaluation moments are:
#   SslBump1: After getting TCP-level and HTTP CONNECT info.
#   SslBump2: After getting TLS Client Hello info.
#   SslBump3: After getting TLS Server Hello info.
# These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
# they can be used there for custom configuration.
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
http_access allow manager localhost

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
http_access allow localhost

request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

# Reverse Proxy settings


# Custom options before auth
acl https_proto proto https
always_direct allow https_proto
ssl_bump none localhost
sslproxy_options NO_SSLv2,NO_SSLv3,No_Compression
sslproxy_cipher ALL:!SSLv2:!ADH:!DSS:!MD5:!EXP:!DES:!PSK:!SRP:!RC4:!IDEA:!SEED:!aNULL:!eNULL
# TLS/SSL bumping definitions
acl tls_s1_connect at_step SslBump1
acl tls_s2_client_hello at_step SslBump2
acl tls_s3_server_hello at_step SslBump3
# TLS/SSL bumping steps
ssl_bump peek tls_s1_connect all
ssl_bump splice all
# peek at TLS/SSL connect data
# splice: no active bumping

ssl_bump peek step1
ssl_bump bump all
# Setup allowed ACLs
# Allow local network(s) on interface(s)
http_access allow localnet
# Default block all to be sure
http_access deny allsrc
 
You must log in or register to reply here.
Back
Top