Re: https inspection using intermediate CA

Fabian Keil <[email protected]> Mon, 8 Aug 2022 12:02:45 +0200

Newsgroups	gmane.comp.web.privoxy.user
Message-ID	<[email protected]>

Chakib Benziane <[email protected]> wrote on 2022-08-07 at 22:27:37:

> I am tring to use https inspection using a CA that is an intermediate
> not Root and the TLS handshake is failing between client and privoxy. 
> 
> I tracked down the problem to the generation of host certificates which
> sets the "Issuer" of the cert the same as the Issuer of the provided CA
> file. This works well when the provided CA the Root but in my case I
> want to use an Intermediate CA which is the only CA I deploy on my
> machines.

Thanks for tracking down the issue and letting us know.
 
> Is there a reason why you are copying the Issuer field from the CA to
> the host certificate ? 

I haven't had time to look at the code yet, but often things are
done because they seem to work for the tested use cases.

> Why not set the Issuer of the generated certificate as the Subject of the CA
> file ? (see openssl.c L1984 - privoxy-3.0.33-stable)

Can you submit a patch so we can test if your proposed change
still works with other use cases?

Fabian

_______________________________________________
Privoxy-users mailing list
[email protected]
https://lists.privoxy.org/mailman/listinfo/privoxy-users

signature.asc (application/pgp-signature, 833 B)